Security Industry Monitor Executive Summary

Security Industry Monitor

December 2018

For additional information on our Security Team, please contact:

John E. Mack III Co-head, Investment Banking Group Head of Mergers and Acquisitions (310) 246-3705 [email protected]

Bill Lynch Managing Director, Investment Banking Group (310) 246-3789 [email protected]

Rick Juarez Managing Director, Investment Banking Group (415) 615-4002 [email protected]

Koby L. Tanzer, CFA Head of Israel Office Imperial Capital Israel, Ltd. +972 (54) 720 0999 [email protected]

PLEASE SEE IMPORTANT DISCLOSURES ON LAST PAGE

September 2009 1

Security Industry Monitor Table of Contents

About Imperial Capital, LLC

Imperial Capital is a full-service investment bank offering a uniquely integrated platform of comprehensive services to institutional investors and middle market companies. We offer sophisticated sales and trading services to institutional investors and a wide range of investment banking advisory, capital markets and restructuring services to middle market corporate clients. We also provide proprietary research across an issuer’s capital structure, including bank debt, debt securities, hybrid securities, preferred and common equity and special situations claims. Our comprehensive and integrated service platform, expertise across the full capital structure, and deep industry sector knowledge enable us to provide clients with superior advisory services, capital markets insight, investment ideas and trade execution. We are quick to identify opportunities under any market conditions and we have a proven track record of offering creative, proprietary solutions to our clients.

Imperial Capital’s expertise includes the following sectors: Aerospace, Defense & Government Services, Airlines & Transportation, Business Services, Consumer, Energy (Clean Energy and Traditional Energy), Financial Services, Gaming & Leisure, General Industrials, Healthcare, Homebuilding & Real Estate, Media & Entertainment, Security & Homeland Security and Technology.

Imperial Capital has three principal businesses: Investment Banking, Institutional Sales & Trading and Institutional Research.

For additional information, please visit our Web site at www.imperialcapital.com.

2 December 2018

Security Industry Monitor Table of Contents

Table of Contents Section I Executive Summary ...... 5 Defining the Security Industry 7 Macroeconomic Overview 9 Equity Performance and Valuation 11 M&A Snapshot 15 Public Debt and Equity Offerings Snapshot 16 Registered Direct and Private Placement Snapshot 16 Bankruptcies Snapshot 17 Security Industry Transactions Outlook 17 Physical Solutions Overview 18 Identity Solutions Overview 18 Information Security Overview 19 Section II Sector ...... 21 Sector Outlook and Commentary 23 M&A Review and Outlook 40 Notable Middle Market Transactions 40 Registered Direct and Private Placement Snapshot 42 Public and Rule 144A Debt and Equity Offering Snapshot 43 Bankruptcies 43 Section III Identity Solutions Sector ...... 47 Sector Outlook and Commentary 49 M&A Review and Outlook 53 Notable Middle Market Transactions 53 Registered Direct and Private Placement Snapshot 54 Public and Rule 144A Debt and Equity Offering Snapshot 54 Bankruptcies 54 Section IV Information Security Sector ...... 57 Sector Outlook and Commentary 59 M&A Review and Outlook 66 Notable Middle Market Transactions 66 Registered Direct and Private Placement Snapshot 67 Public and Rule 144A Debt and Equity Offering Snapshot 67 Bankruptcies 67 Section V Unmanned Aerial Systems Sector ...... 71 Sector Outlook and Commentary 73 Notable M&A Transactions 85 Registered Direct and Private Placement Snapshot 85 Bankruptcies 85 Section VI Appendix ...... 89 Comparable Companies 91 Valuations—Security Industry Companies 95 Disclosures ...... Last Page

December 2018 3

Executive Summary Security Industry Monitor

[This page intentionally left blank.]

4 December 2018

Security Industry Monitor Table of Contents

Section I

Executive Summary

December 2018 5

Executive Summary Security Industry Monitor

[This page intentionally left blank.]

6 December 2018

Security Industry Monitor ExecutiveTable of Summary Contents

Executive Summary Defining the Security Industry

The December 2018 edition of the Imperial Capital Security Industry Monitor focuses on two major trends: 1) the rise of leading independent monitoring companies, and 2) improving communication and verification for emergency centers and first responders.

The first trend we identify is the rise of leading independent monitoring companies benefiting from the growth of do-it-yourself (DIY), large technology, and cable/telco as home automation companies become aware of the need to offer a monitoring and response option for interested clients. Ten years ago, the independent, or wholesale, monitoring business was a somewhat sleepy segment of the security industry. They provided monitoring services to those security dealers who did not have the size, capital, or simply did not like the task of monitoring and servicing clients. Today, the independent monitoring companies appear to be growing in the mid-teens, twice the rate of the overall electronic security industry. A disproportionate part of that fast growth is centered on a few companies that have invested heavily in technology and infrastructure in order to market to and take on the volume demands of recent entrants into the industry.

In our December 2017 Premises Control and Automation: Outlook for 2017-2024 white paper we estimated that for nearly a decade the alarm industry’s fee-based security penetration of total U.S. homes has been stagnant at roughly 20%. However, we estimate that the penetration rate will accelerate to 42% of U.S. homes by 2024.

Improving communication and verification for emergency centers and first responders is another important focus. The very growth in new systems that feeds the growth of the independent monitoring companies is also exacerbating a serious issue for the industry, which we discuss in more detail in the second part of our Physical Security section of this Monitor. The problem is the sheer increase in volume of alarms, 90-95% of which are false. Historically, the communication capabilities between the industry’s monitoring centers and emergency centers 911 dispatchers have neither been accurate enough nor quick enough to encourage first responders to act more quickly on alarms. The false alarm problem has slowed police response, except in cases where an event is clearly verified, and has led to ever more onerous fines for end users, and some alarm companies, for false alarms, unless there was some human or device-driven proof that the event was happening. This trend has led to longer response times, increased fines, and even discontinuance of any response in some situations, where unverified alarms proved false. These lengthening response times and the increase in fines already presented a challenge to the value proposition (i.e., RMR being one representation of this), even before this new acceleration of growth in the number of professionally monitored – and now increasing self-monitored – security systems.

Over the last 15 years, the alarm industry, in conjunction with the leading responder organizations has developed an Automated Secure Alarm Protocol (ASAP). Over the last seven years, some 35 companies and nearly 40 Public Safety Answering Point (PSAP) jurisdictions (with double the amount in process) have developed the ASAP-to-PSAP process. According to numerous case studies this process has successfully automated communications between monitoring companies and PSAP operators, cutting down the time to communicate by about 80-90% and greatly reducing errors. While ASAP-to-PSAP is a definite improvement over prior ad hoc solutions by individual companies, it is not a panacea. ASAP-to-PSAP does not deal with the initial verification of an event, and many companies cannot afford the costs of upgrading software and 4G communications capabilities, leaving the very largest companies to disproportionality fund these improvements for their competitors.

December 2018 7

Executive Summary Security Industry Monitor

Nonetheless, there are many technology and product choices that complement or add independent verification capabilities that we believe bring us closer to an acceptable combination of verification and improved communication between monitoring centers and ultimately the first responders that protect our health and safety. We are not at that point, but the industry is no longer making light of this critical issue as some critics contend.

We visited several of these high-growth monitoring companies and conducted operational due diligence, including their human resources strategy, infrastructure and redundant capabilities, technology stack, as well as companies they are working with to help identify and verify events. In the Physical Security section, we provide details on some of our general findings.

Within the identity solution sector, we explore a raft of new escalations in nearly every form of counterfeiting and grey market scams, some of which have been broken up, regarding everything from pharmaceuticals to textiles to “legacy” items such as luxury goods and cash. We highlight the fact that several products and services will be needed to authenticate and show provenance for areas with newly legalized cannabis use. The industry will need to find ways to ensure that medical marijuana on the market is what it says it is and grown where it says it is grown. We anticipate there will be significant challenges as the industry completely turns over.

Within the information security sector, we highlight the challenges facing all organizations by the overwhelming volume of alerts from an array of deployed security tools and sensors, impeding their ability to validate, prioritize, and respond to the most critical threats. We discuss the application of key technologies, such as artificial intelligence (AI) and machine learning (ML), to enable more sophisticated analytics, data correlation, and higher fidelity alerts. We also discuss one of the most critical challenges facing the industry, the rapid proliferation of Internet of Things (IoT) devices. These risks have real world implications on life safety and national security, which is driving rapid convergence of cyber-physical security. We additionally expand upon the first-ever legislation passed in the United States mandating the implementation of new security features into IoT devices, potentially paving the way toward increasing global regulation.

This edition of the Security Industry Monitor also includes a deep delve into the development of Unmanned Aerial Systems, (a step up the chain from simple UAVs or Unmanned Aerial Vehicles, more commonly known as “drones”). We explore how the passage of the FAA Reauthorization Act of 2018 (H.R. 302) is a significant step toward a more formal UAS integration into the National Air Space (NAS). H.R. 302 includes provisions outlining the implementation of an UAS Traffic Management System, the implementation of Beyond Line- of-Sight (BVLOS) and remote ID for NAVs. These are all significant pieces of the puzzle for UAS integration and important for security providers exploring and/or implementing drone programs.

° Physical Security (alarm monitoring, premises control and automation, integration, , video analytics, guards, and armored transport, cash logistics) ° Identity Solutions (biometrics, RFID, NFC/BLE, digital watermarking, and anti-counterfeiting technologies) ° Information Security (cloud, SaaS, endpoint/network/application, threat detection, IAM, encryption) ° Unmanned Aerial Systems

8 December 2018

Security Industry Monitor ExecutiveTable of Summary Contents

Figure 1: A Substantial, Multi-Segment, and Fragmented Industry with $350+ Billion in End User Revenues

Sources: Imperial Capital, LLC.

Macroeconomic Overview

U.S. real GDP expanded 3.5% in the third quarter of 2018, compared to 4.2% in the second quarter of 2018. While the U.S economy has experienced one of the best six-month stretches in the past decade, the Federal Reserve is anticipating a slowdown that will see the growth rate taper off to 2.5% by the first quarter of 2019. This cooldown will be influenced by a deceleration in income-tax cut driven consumer- spending growth and a potential fade in federal government spending if the budget agreement is not renewed in September 2019. Offsetting these headwinds is business investment growth, which has faded since registering 11.5% in the first quarter of 2018, but has the potential to rebound given a pared corporate tax rate, although trade skirmishes with China and others are poised to threaten such expansion.

December 2018 9

Executive Summary Security Industry Monitor

Figure 2: GDP Components, Annualized Quarterly Changes, 3Q17 versus 3Q18

25.0%

20.0% State and local and State 15.0% products Equipment products 10.0% Imports Intellectual property property Intellectual expenditures expenditures Intellectual property property Intellectual National defense National Personal consumption Personal

5.0% local and State National defense National Personal consumption Personal Exports Nondefense Equipment 0.0%

(5.0%) Imports Nondefense Residential Exports

(10.0%) Residential 3Q2017 3Q2018 Structures Structures Sources: U.S. Bureau of Economic Analysis.

° The increase in real GDP in the third quarter primarily reflected positive contributions from consumer spending and private inventory investment that were partly offset by a negative contribution from exports. Imports, which are a subtraction in the calculation of GDP, increased

Within exports, the downturn primarily reflected downturns in foods, feeds, and beverages (primarily soybeans), in petroleum and products, and in non-automotive capital goods. The upturn in imports was mostly accounted for by consumer goods and motor vehicles, while the upturn in private inventory investment was widespread. The leading contributors were wholesale trade (notably farm products) and manufacturing industries.

10 December 2018

Security Industry Monitor ExecutiveTable of Summary Contents

Figure 3: Business Investment and State and Local Government Spending Trends, Annualized Quarterly Changes, 1Q14 to 3Q18

35%

25%

15%

5%

-5%

-15%

-25% 1Q14 3Q14 1Q15 3Q15 Q116 Q316 Q117 Q317 Q118 Q318 Structures Equipment Intellectual property products State and local

Sources: U.S. Bureau of Economic Analysis.

Equity Performance and Valuation

° The relative stock returns of the Security Industry comparable companies that we analyzed were moderately higher than the S&P 500 over the past quarter

Since the markets reached a 12-year low in March 2009, the select group of Security Industry comparable companies that we have listed has generally exceeded the S&P 500 return. Over the last 12 months, this select group of security companies performed favorably versus the S&P 500 due to: 1) ongoing need for security in a more dangerous world; 2) the increasing ability of security to demonstrate return on investment (ROI) to business executives and consumer value to residential customers; 3) the improvements in service resulting from the increasing use and evolution of Internet Protocol (IP) and interactive technologies; 4) a sustained robust M&A environment for the sector.

° Security Industry valuations for Physical Security, Identity Solution and Information Security have steadily increased from September 2017 to through September 2018

Security Industry valuations as a whole, based on EV/LTM EBITDA at the end of 3Q18, increased by 15.5% compared to 3Q17, primarily driven by a sharp increase of 35.1% year-over-year in the Identity Solutions Sector.

December 2018 11

Executive Summary Security Industry Monitor

Figure 4: Valuation Multiples, EV/LTM EBITDA, 3Q17 versus 3Q18 (1)

Industry / Sectors September 30, 2017 September 30, 2018 Year-over-Year Change Security Industry 11.0x 12.7x 15.5% Physical Security Sector 11.6x 11.6x (0.2%) Identity Solutions Sector 10.0x 13.5x 35.1%

Information Security Sector 11.4x 13.0x 14.3% Notes: Measured relative to period ending 9/30/17; LTM EBITDA based on reported financial results as of the date of this report. Companies used to generate these multiples are listed in the Appendix of this report. Sources: Imperial Capital, LLC and Capital IQ.

° Public valuations in the Physical Security sector remained flat year-over-year in the third quarter of 2018

The Physical Security sector tends to have steadier and more predictable cash flows versus other Security segments as a result of its recurring revenue and relative maturity. Physical Security valuations hit a historical low during the first quarter of 2009, but rebounded significantly in 2010 despite market volatility earlier in that year. After several high-profile M&A transactions in the alarm monitoring space pushed valuations up during the end of 2010 and the beginning of 2011, valuations declined during the second half of 2011. Since that point, valuations in the Physical Security sector have steadily climbed, driven primarily through increased M&A, a rebound in installation activity, low interest rates, and an expanding economy. Current LTM average multiples of 11.6x sit above the 3 year and 6 year averages of 11.0x and 9.9x, respectively.

Figure 5: Physical Security Sector Historical EBITDA Multiples, December 2011 to September 2018(1)

13.0x EV / LTM EBITDA 12.0x 11.0x 10.0x 9.0x 8.0x 7.0x 6.0x

Last Twelve Months Mean Long Term Average (1) Companies used to generate these multiples are listed in the Appendix of this report. Sources: Imperial Capital, LLC and Capital IQ.

12 December 2018

Security Industry Monitor ExecutiveTable of Summary Contents

° Public valuations in the Identity Solutions sector have exhibited tremendous growth since September 2017

The Identity Solutions companies that we analyze traded at 13.5x LTM EBITDA on average in 3Q18, up from 10.0x during the same period a year earlier. Identity Solutions technology, from software to biometric equipment, is continuing to mature, as evidenced by its increasing adoption by an array of government and defense programs in response to increased security threats, international identification programs, as well as increased cloud-based hosted access and ID systems being installed by integrators for both government and commercial sites.

Figure 6: Identity Solutions Sector Historical EBITDA Multiples, December 2011 to September 2018(1)

14.0x 13.0x EV / LTM EBITDA 12.0x 11.0x 10.0x 9.0x 8.0x 7.0x 6.0x 5.0x

Last Twelve Months Mean Long Term Average (1) Companies used to generate these multiples are listed in the Appendix of this report. Sources: Imperial Capital, LLC and Capital IQ.

December 2018 13

Executive Summary Security Industry Monitor

° Public valuations in the Information Security sector increased 14.3% on a year-over-year basis

Public valuations in the Information Security sector increased by 14.3% compared to the corresponding period in 2017 on an EV/LTM EBITDA basis. Valuations steadily traded below their long-term historical averages in 2013 and 2014, touched the long-term average in 2Q15, and then fell back below the long-term average by the end of 2015. In late 2010 and early 2011, several M&A transactions provided a short-term increase to valuations, events which were not repeated in 2012. 2H17 experienced a large uptick in the EV/LTM EBITDA ratio to 11.4x. Of late, the information security subsector has been bifurcated from a performance and valuation perspective. Broad-based increases in budget outlays against cybercrime and M&A have been helped by companies such as Palo Alto Networks, Qualys, Fortinet, Proofpoint, and Imperva. Cutbacks in government-related IT programs have adversely affected or blunted valuation growth in larger index companies, such as IBM, Hewlett Packard, CA Technologies, and Juniper Networks.

Figure 7: Information Security Sector Historical EBITDA Multiples, December 2011 to September 2018(1)

EV / LTM EBITDA 14.0x

12.0x

10.0x

8.0x

6.0x

Last Twelve Months Mean Long Term Average

(1) Companies used to generate these multiples are listed in the Appendix of this report. Sources: Imperial Capital, LLC

14 December 2018

Security Industry Monitor ExTableecutive of Summary Contents

M&A Snapshot

° The first three quarters of 2018 highlighted continued resilience in the M&A market

M&A activity showed strong growth in 1Q18, beating that of 1Q17. The first three quarters of 2018 were more active than that of the comparable period in the prior year. The first three quarters of this year experienced 359 M&A transactions, which is slightly more than the first three quarters of 2017 with 354 M&A transactions. The security industry is maintaining strong M&A activity.

Figure 8: Historical M&A Transactions in the Security Industry, 3Q13 to 3Q18

160

140

120

100

80

60

40

20

- Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 2013 2013 2014 2014 2014 2014 2015 2015 2015 2015 2016 2016 2016 2016 2017 2017 2017 2017 2018 2018 2018 Physical Security Sector Identity Solutions Sector Information Security Sector

Sources: Imperial Capital, LLC and Capital IQ.

December 2018 15

Executive Summary Security Industry Monitor

Public Debt and Equity Offerings Snapshot

° Public offerings activity in the first three quarters also displayed robust growth when compared with the total offerings of the first three quarters of 2017

After near record high amounts of public offerings in 2H13, offerings slowed consistently throughout all four quarters of 2014 and remained low in 2015. After a slow start to 2016, overall activity has ramped up and surpassed the levels it saw in 2013 and achieved a record high in 1Q18.

Figure 9: Public Offering Transactions in the Security Industry, 3Q13 to 3Q18

70 65 60 61 60

49 50 45 42 43 40 40 37 37 38

30

21 21 20 19 20 18 18 13 12 10 11 10

- Q3 2013 Q4 2013 Q1 2014 Q2 2014 Q3 2014 Q4 2014 Q1 2015 Q2 2015 Q3 2015 Q4 2015 Q1 2016 Q2 2016 Q3 2016 Q4 2016 Q1 2017 Q2 2017 Q3 2017 Q4 2017 Q1 2018 Q2 2018 Q3 2018

Sources: Imperial Capital, LLC and Capital IQ.

Registered Direct and Private Placement Snapshot

° Registered direct offerings and private placements in the Security Industry have seen robust growth in the first three quarters of 2018 and set a record high in 2Q18

Registered direct offerings and private placements in the security industry have been steadily climbing since the low in 2Q16. The number of offerings in the first three quarters of 2018 has significantly outpaced the number of offerings in the first three quarters of 2017.

Figure 10: Historical Registered Direct and Private Placement Transactions in the Security Industry, 3Q13 to 3Q18

220 209 200

180 170 155 158 160 146 142 138 133 136 140 127 116 120 120 101 100 91 81 79 80 77 80 73 69 73 60

40

20

- Q3 2013 Q4 2013 Q1 2014 Q2 2014 Q3 2014 Q4 2014 Q1 2015 Q2 2015 Q3 2015 Q4 2015 Q1 2016 Q2 2016 Q3 2016 Q4 2016 Q1 2017 Q2 2017 Q3 2017 Q4 2017 Q1 2018 Q2 2018 Q3 2018

Sources: Imperial Capital, LLC and Capital IQ.

16 December2018

Security Industry Monitor ExTableecutive of Summary Contents

Bankruptcies Snapshot

° The Security Industry had an increase in bankruptcies in the first three quarters of 2018 relative to the first three quarters of 2017

The Security Industry has witnessed five bankruptcies in the first three quarters of 2018, with relevant activity staying within the one to three bankruptcy range. There were three bankruptcies in the first three quarters of 2017.

Figure 11: Historical Bankruptcy Transactions in the Security Industry, 3Q13 to 3Q18

4

3 3 3 3

2 2 2 2 2 2

1 1 1 1 1 1

------Q3 2013 Q4 2013 Q1 2014 Q2 2014 Q3 2014 Q4 2014 Q1 2015 Q2 2015 Q3 2015 Q4 2015 Q1 2016 Q2 2016 Q3 2016 Q4 2016 Q1 2017 Q2 2017 Q3 2017 Q4 2017 Q1 2018 Q2 2018 Q3 2018

Sources: Imperial Capital, LLC and Capital IQ.

Security Industry Transactions Outlook

Figure 12: Security Industry Transactions Outlook

t b e s t nd s a A De ng v 4 i a nt s A 4 r ct e e fe e i & 1 r em c M e c ul Di a and Pri d rupt re Pl e e nk egic Equity a t vat B ra c and R gist i e Pri St bl and Equity OfR Pu

Physical Security

Identity Solutions

Information Security

*Arrows reflect what we view as current trends for each of these areas. Sources: Imperial Capital, LLC.

December 2018 17

Executive Summary Security Industry Monitor

Physical Solutions Overview

Physical Security Services transactions were relatively consistent with prior quarters, albeit slightly higher in terms of volume.

° Strategic and private equity M&A

The Physical Security market activity experienced a strong first three quarters of 2018 relative to the first three quarters of 2017.

° Public and Rule 114A debt and equity offerings

Physical Security public debt and equity offerings saw no major movement compared to the first three quarters of 2017.

° Registered direct and private placements

The market for private placements experienced significant growth in the first three quarters of 2018 relative to the first three quarters of 2017.

° Bankruptcies

There were a few Physical Solutions bankruptcies during 1Q18.

Identity Solutions Overview

Activity in the Identity Solutions sector was consistent in the first three quarters of 2018 relative to the first three quarters of 2017.

° Strategic and private equity M&A

The Identity Solutions M&A activity level fell slightly in the first three quarters of 2018.

° Public and Rule 114A debt and equity offerings

Public debt and equity offerings remained at similar levels compared to the first three quarters of 2017.

° Registered direct and private placements

Identity Solutions private placement activity in the first three quarters of 2018 was significantly greater than the first three quarters of 2017.

° Bankruptcies

There were no significant Identity Solutions bankruptcies during the first three quarters of 2018.

18 December2018

Security Industry Monitor ExTableecutive of Summary Contents

Information Security Overview

M&A fell slightly in the first three quarters of 2018 in the Information Security Sector, but experienced growth in public and private placements.

° Strategic and private equity M&A

M&A in the sector slowed slightly in the first three quarters of 2018 compared the same period the year prior.

° Public and Rule 114A debt and equity offerings

Public offerings in the Information Security Sector experienced growth in the first three quarters of 2018.

° Registered direct and private placements

Private placement activity has grown in the past three quarters of 2018.

° Bankruptcies

There were some minor Information Security Bankruptcies in the first three quarters of 2018.

December 2018 19

Executive Summary Security Industry Monitor

[This page intentionally left blank.]

XXXXXX

]

20 December2018

Consumer Industry Monitor Executive Summary

Section II

Physical Security Sector

December 2018 21

Physical Security Sector Security Industry Monitor

[This page intentionally left blank.]

22 December 2018

Security Industry Monitor Physical Security Sector

Physical Security Sector

Sector Outlook and Commentary

The Once “Sleepy” Independent Monitoring Industry Is Growing Faster Than the Rest of the Industry

As recently as five years ago, the independent/wholesale premises monitoring business was a slow growing and quiet part of the alarm monitoring industry. It was mainly responsible for monitoring accounts of mostly small alarm dealers who wanted to offload all or part of their clients’ monitoring services to focus on what they considered their best capability: selling and installing security alarms.

Today, the independent monitoring industry has become the fastest growing segment of an advanced premises automation industry that provides services for home automation, do-it-yourself, mobile and traditional personal emergency response providers, small and medium-sized business (SMB) commercial users (some with sophisticated video as a service [VSaaS] installations to monitor), cable and telco operators, leading edge technology companies entering the business, public safety systems, and finally, traditional and not-so-traditional security dealers (Source: SDM Magazine and Barnes Associates).

There are still some of same leading names in the top six to eight independent monitoring companies from ten years ago, but the list has turned over by about 50% to accommodate select companies that have seized the opportunity to take advantage of the near-paradigm shift taking place in both small business and residential premises automation. However, based on our interviews with management teams and responders, we believe that the percentage of market share is growing more concentrated at the very top.

The Leading Integrated Companies Are Not Going Away, even as the Independents Challenge Their Value Proposition

The one issue we continue to encounter that we have reservations about is the claim that the independent monitoring centers – even with the prodigious improvements made over the last 5-8 years – can provide the same level of services to their clients as the leading integrated companies. When we look at companies such as ADT Inc., Brink’s Home Security, Vivint, Vector Security, Guardian Protection Services, and CPI Security in the U.S. and Verisure in Europe, we see not just a longer menu of services, but broader service to the entire spectrum of enterprise-to-residential customers. There have been some service glitches among the independents as they were investing in trying to keep up with demand. The best integrated providers have direct touch with their end users. This provides substantial challenges to those integrated premises automation companies not up to the task of going one-on-one with their end users (and sometimes responders) at the same time. However, for those integrated companies that can meet these challenges, the advantages of having direct touch with end users can mean longer customer lives and greater control over upgrades.

December 2018 23

Physical Security Sector Security Industry Monitor

Now, these multitudes of services and the customer touch come at a cost. For example, ADT or even Verisure still have to convince their existing and prospective customers that their value proposition is worth the recurring monthly charge of $40 or more for their professional installation and service capabilities. Meanwhile, DIY and new technology entrants are offering optional monitoring at less than half the cost of an integrated company’s full wireless system to the subscriber.

The Extent of Growth in Independent Monitoring Changed Dramatically as the Industry Changed

We cannot deny that some independent monitoring companies are benefiting mightily from the major changes in DIY and pricing affecting the residential market. To illustrate this point, let’s look at a survey which is part of an annual presentation given by industry consultant Michael Barnes at the Barnes Buchanan Conference. This survey was conducted in conjunction with SDM Magazine, as well as a survey of independent monitoring companies done in conjunction with Security Systems News. The survey looks at the growth of the “SDM Top 100” security companies, the independent monitoring companies, and those monitoring companies that were not part of either survey.

For Barnes’ 2014 report (on 2013 revenues), the electronic monitoring industry grew an aggregate of 9%, coming out of the Great Recession. The SDM 100 comprised 55% of the electronic monitoring industry revenues and grew 7%, but notice the RMR growth of the independent segment: it is at least double the other segments from the 2014 survey results to the 2017 results, due initially to cable clients gaining new security monitoring customers, and then moving those customers from their own in-house and generic customer service rep centers to the independents. Cable clients moving to independent monitoring coincided with newer DIY and technology entrants also offering monitoring to homeowners as an option.

In 2015, Mr. Barnes reported, to his surprise, that the year-over-year recurring monthly revenue (RMR) change for wholesale monitoring was 15% higher than 7% for the top 100 in SDM Magazine’s annual survey.

In 2016, Mr. Barnes increased his estimate for wholesale monitoring’s percentage of the business and has continued to increase its estimated percentage to 25% of the market, as of February 2018. We suspect that the February 2019 report will show a further gain in market share for the segment.

24 December 2018

Security Industry Monitor Physical Security Sector

Figure 13: Revenue Growth by Industry Segment per the Annual Barnes Buchanan Presentation in Conjunction with SDM Magazine and Security Systems News

Segment Total Install/RMR Market Size ($bil) Pct of Market (%) RMR Growth Market Growth 2014 Total Market $49bn 100% 9% SDM 100 27.0bn 55% 7% Independent 7.8bn 16% 19% Not Surveyed 14.2bn 29% 9%

2015 Total Market $52bn 100% 8% SDM 100 27.6bn 53% 7% Independent 9.4bn 18% 15% Not Surveyed 15.1bn 29% 6%

2016 Total Market $55bn 100% 7% SDM 100 27.0bn 49% 5% Independent 9.4bn 25% 14% Not Surveyed 15.1bn 26% 6%

2017 Total Market $58bn 100% 6% SDM 100 27.8bn 48% 5% Independent 14.5bn 25% 14%

Not Surveyed 15.1bn 26% 6%

Note: Segment RMR Growth does not include sales and installation. Sources: Barnes Associates, SDM Magazine, Security Systems News, and Security Sales & Integration.

Barnes’ report leaves off who in the independent monitoring world drives this market share, which is the focus of our report. Based on our interviews with industry company management teams, IoT companies, and responders, we believe the mid-teens growth of the Barnes surveys translates into a sizable bifurcation going on between the few top companies, growing revenues in the high double digits, and a broader group of smaller independent monitoring companies, whose revenues are likely static or falling heading into 2019.

December 2018 25

Physical Security Sector Security Industry Monitor

Why Are a Few of the Independent Monitoring Companies Growing So Fast?

We believe that studying the independent monitoring companies – both the winners and the also-rans – can provide some intriguing insights into 1) the growth of the small security dealers, which formed the base of the original group of accounts for the independents, 2) the fast growth of some new “age” IOT home system providers, 3) the success of some, and lack of success of other, MSO providers in penetrating the home and commercial premises control business, and 4) the value proposition of lower monthly costs paid to independent central stations versus the fully integrated security companies such as ADT Inc., Brinks Home Security, Vivint, Vector, Guardian Protection, and CPI (in Europe and Latin America).

Independent monitoring providers are investing heavily in technology and human resources, trying to show that they have the capabilities to monitor and analyze virtually anything that can be tied to the premises, including many critical aspects of a human being’s life where human intervention can help. Advances in communications between the residential/commercial premises, monitoring centers, emergency response centers, intelligent and predictive video, and intelligent and predictive access control and mobile health, and even unmanned aerial vehicles, all radically change the scope of revenues available to the independent monitoring centers. However, these advances also raise the bar to become successful. The challenge for the independent centers as they gather and analyze data from all these sources is the issue of scale: 1) can they keep up with the growth and scale demands of some of their newer giant MSO and technology clients, 2) can they keep up with the increasing need for cybersecurity in the premises and between the premises and the monitoring station, and 3) how do they manage privacy: to whom does the data belong and can the monitoring centers use it?

We believe the most obvious reason for the growth of independent monitoring is the realization by MSOs, technology giants, and DIY entering the market that their relative lack of emergency call center operational and service expertise to police, health care, and fire responders puts them at a disadvantage to more traditional providers who have dealt with responders for decades. As a result, the leading MSOs in home automation have opted to outsource that part of their monitoring, response, and service, away from in-house centers and generic customer service representative (CSR) centers to more trusted partners who have been in the critical monitoring business for years, sometimes decades.

These newer entrants into the home automation industry are in it to control the home, not just to provide better security. They include:

° Multiple System Operators (MSOs), such as:

° Cable: Comcast, Cox, Spectrum ° Telco: BCE Inc., AT&T (Digital Life) ° Tech/Internet: Google (Nest), Amazon (Alexa, Ring), Samsung (SmartThings)

° DIY: Simplisafe, Arlo Technologies, Ooma Inc., Protect America, Frontpoint

26 December 2018

Security Industry Monitor Physical Security Sector

Lack of Expertise in Monitoring and Service Has Driven New Market Entrants to the Independent Monitoring Companies

This lack of expertise by new entrants has some key touchpoints: We note that AT&T launched its Digital Life security business in 2013, with its own monitoring and customer service centers. The company had some effective commercials during the 2016 Olympics, and as of the end of 2016 was available in 84 U.S. markets. However, we have not seen any marketing or any new products from Digital Life since August 2017. We wonder if AT&T will finally sell the business or return to it using one of the independent monitoring and service companies. We have not been able to learn about either option.

Verizon also launched a security business in 2011: DIY kits ordered online and sent to the home (similar to Protect America, the original and largest monitored DIY company). However, Verizon abandoned the business two years later. A report by Reuters in 2013 noted service problems and lack of DIY experience on the internet were the reasons for the business failure. The company has yet to come back to the market. We assume it will return at some point, and we would once again ask how it will handle its monitoring, dispatch, and customer service.

The more successful “traditional” DIY companies such as Protect America, Frontpoint, LiveWatch (now part of Brinks Home Security), and lately, Simplisafe, offer monitoring, and they are all handled by the leading independent monitoring companies, with the exception of LiveWatch.

As noted above, the independent monitoring industry is in major flux – with higher growth rates than electronic security overall – but those higher growth rates are centered on a few leaders at the top. As these higher growth companies realized early on (within five to eight years ago), they have to focus on a high level of investment in redundant infrastructure, technology-savvy software writers (APIs are becoming critical to broaden and make easier the integration of add-ons after the initial installation), and investments in new customer-centric analytic services and technologies in order to be a leading company.

Independent Monitoring Must Compete for Technology Talent

The dramatic improvement in the last two years in analytics (leading to associated technologies of deep machine learning, predictive analytics, and artificial intelligence) has created a need to hire as many (or more) software professionals in premises monitoring companies as customer service representatives and administrative personnel. Keeping talented employees requires the ability to pay them competitive rates and to invest in a working environment that is conducive to younger employees, while promoting a high degree of success from writing code to servicing customers. For those few with the capital and the management who understand these needs in “the old” security industry, this creates an advantage against smaller independent central stations that do not have the capital to invest. It also creates an advantage against smaller-to-medium sized integrated security companies that must also divide their investment between marketing and acquiring individual clients against investing in the monitoring and emergency services communication infrastructure. At the same time, internal efficiencies and high skill in choosing the most productive personnel for monitoring, customer service, software development, and infrastructure development can eventually produce a lower cost to serve clients, driving up not just margins, but also providing the ability to price services at a lower cost for competitive purposes.

December 2018 27

Physical Security Sector Security Industry Monitor

A Critical Intersection for the Industry: Verification Technology and the ASAP-to-PSAP Protocol. Will the Independents Need to Adopt to Satisfy False Alarm Issue?

Technology leadership and efficiency leadership lead us to one more reason the leading independent monitoring companies are getting so much new business now: the issue of verification, false alarm, and the value proposition of having the fastest law enforcement/healthcare/fire response when an event occurs. This is about to go from being an issue that is a topic of conversation to one that could be essential to a premise automation company’s value proposition. According to an Urban Institute study conducted in 2014, 90-99% of the alarms police respond to are false. Police response has slowed dramatically, unless human or machine verification proves there is a valid reason, and communities have instituted fines (some very onerous) for repeat false alarm offenders. This is one reason why the traditional residential security industry penetration remained stuck at about 20% of residences for nearly a decade (see our December 2017 Premises Control and Automation: Outlook for 2017-2024 white paper). However, IHS Markit now believes that these new entrants into the home automation industry are the catalyst for about 49-50% annual growth in cloud-based smart home devices. A survey of five leading market consulting firms shows a mean growth rate of “connected homes” ranging from 14.5% to nearly 30% over the next five years. In conclusion, if police are overwhelmed by responding to alarms on 20-21 million homes that are false today, they are almost certain not to respond to signals on 30 million homes in several years, unless there is a trusted verification protocol put in place.

Therefore, we are highly focused on investigating which of the independent monitoring companies have joined, or are preparing to the join, the ASAP-to-PSAP program being instituted by cooperating industry, community and responders organizations. That is, in full, “The Automated Secure Alarm Protocol-to-Pubic Safety Access Point” program. The ASAP program is a computer-aided dispatch system, which over the last 15 years has been integrated into a nationally connected network to centers with 911 operators. By using verified signals, and eliminating most human interface, false alarms have been dramatically reduced in every city that has adopted the program.

One of the most important developments in the security industry is the rise of automated signaling from verified (video and audio) sensors, which allow software at the monitoring center to alert the 911 system with a very low incidence of false alarms, little or no human interaction, and a dramatic increase in speed over formerly phone-to-phone human interaction (ASAP-to-PSAP, see the discussion in the next section). As the number of smart homes sending out signals from various types of sensors surges, the false alarm issue of police response, community fines, and a worsening value proposition will create a giant gap between the haves and the have not’s in the home automation industry. However, this industry-critical technology cannot be employed without investment in wireless technology and upgrades of most central monitoring center software. Traditional POTS (plain old telephone service) lines systems, and most remaining 2G and even many 3G wireless systems, will have to be upgraded to 4G in order to process the signals for ASAP-to-PSAP. Not all the major independent monitoring companies have signed on to this program yet, which is active in nearly 40 cities, with another 40 in process. See further commentary in our discussion of Emergency Monitoring Technology.

28 December 2018

Security Industry Monitor Physical Security Sector

Personal Emergency Response Is an Important – and Growing – Service Offering

Yet another reason for the continued market gains of the independent monitoring companies is the potential seen in the industry for the aggressive and combined growth of traditional personal emergency response systems (PERS), with advanced PERS and with mobile wireless health care monitoring. According to the U.S. Census Bureau, between 2016 and 2030, the number of people aged 70 to 84 will increase by 17.5 million to a total of 42 million, or about 4% annually. For about a decade, a relatively large number of dedicated PERS monitoring companies have focused solely on marketing to aging end users and their families. In addition, a small group of PERS companies marketed to the health care institutions and health care payers instead.

However, technology and smaller form factors (i.e., the Apple Watch and mobile health care watches from Johnson Controls, Stanley Security, etc.) have continued to improve and point toward more passive monitoring of bodily functions and location services that cover a much larger area with greater accuracy. PERS companies trying to make the switch to these new technologies depend on independent monitoring companies more than ever for help. We believe that regardless of whether the dedicated PERS providers succeed, or new wearable health care technology companies also succeed, they are all going to need monitoring capability that results in the correct response. That response can be a quick dispatch, or it could mean a healthcare specialist at the monitoring center staying and consulting on the phone with the end user for 30 minutes. Much larger and more accurate location leading central monitoring stations require dedicated and certified personnel to handle these special calls and consultations.

Finally, cloud-based monitoring solutions in video and access control provide a long list of improvements not just in security, but in human resources, building management, and in the company’s business processes. These services can also be adapted for residential use. However, monitoring cloud-based services requires significant training, which will put further pressure on small integrated and independent monitoring centers to seek outside help, most likely from the leading independent providers.

The Leading Independent Monitoring Companies

Unless they are divisions of larger companies, all the “wholesale” monitoring companies are currently privately owned, many with private equity investment, some still owned by families. Given the private nature of these companies, what could be termed intense competition at the top, and the lack of reliable statistics, we have had to ask management teams, competitors, and customers for as much information as possible. Based on these conversations, we have come up with a short list of leading independent monitoring companies in North America. Specifically, we have met with senior and operating management teams at the headquarters of COPS Monitoring, Rapid Response Monitoring, and Affiliated Monitoring.

° COPS Security, based in Williamstown, New Jersey, with seven central stations, 3,500 dealer clients, representing some 2.8 million customers, is the largest independent monitoring company. Apart from its small and medium alarm dealers, the company also has significant MSO and DIY clients. On its web site, the company notes that its goal is to respond to incoming calls within 20 seconds, and that for the last month, it has averaged 16.5 seconds.

December 2018 29

Physical Security Sector Security Industry Monitor

° Criticom Monitoring Services, based in Manasquan, New Jersey, three central stations, including Florida and California. (formerly a division of Protection 1, and now, ADT), and 800,000 end customers.

° Rapid Response Monitoring Services, based in Syracuse, New York, two central stations. As of 2017, 1,700 dealer clients representing some 1.4 million subscribers (and the winner of the Monitoring Association’s 2016 Central Station of the Year). In 2017, Rapid Response increased its UL capacity from 40,000 square feet to 75,000 square feet in its two central stations, one in Syracuse, and a redundant facility in Corona, California. A third facility in Syracuse is tied into Corona but is not yet fully redundant. The company has about 40 integrations in the ASAP-to- PSAP program.

° EMERgency24, based in Des Plains, Illinois. One of the oldest independents, founded in 1967, the company has a full range of monitoring services, was the first to set up a redundant facility and the first to synchronize alarm signals with video. EMERgency24, is regarded as a leader in video verification and VSaaS services, partnering with Videofied (bought by Honeywell in 2016).

° Affiliated Monitoring, based in Union, New Jersey, two central stations, founded in 1982. Winner of 2018, “Monitoring Center of the Year,” from The Monitoring Association. Affiliated was an early leader in moving PERS into the digital world.

° Acadian Monitoring, based in Lafayette Louisiana, three central stations, including Baton Rouge, Louisiana, and Chicago, Illinois.

As we previously mentioned, we recently met with the management teams at COPS Monitoring, Rapid Response Monitoring, and Affiliated Monitoring. All of the companies are full service, meaning they work with multiple signals, provide multiple service technologies for their clients, and provide multiple consulting and training services to their dealer clients. The senior managements of all three companies are well-known throughout the premises control industry, although we do not believe the operating managements underneath the C-level are as appreciated as they should be by outsiders. To manage through disruptive technological and client change, and to deliver a value proposition under heavy demands from key clients is hard enough. Changing protocols to move ahead in a world where situational verification will determine the quality of response and brand reputation requires a highly trained staff that is always vulnerable to offers from other technology companies. These are common to all of the companies we visited.

We found differences in the way these companies approached training and promoted human talent, differences in how they viewed charging customers, particularly large new entrants, and differences in how much infrastructure/technology investment was needed to maintain the double-digit growth they are all facing.

30 December 2018

Security Industry Monitor Physical Security Sector

COPS Monitoring

We believe COPS is the largest independent monitoring company, with the most clients and the most central stations, and one of the best cost structures in the industry. COPS views what is going on now in the changing nature of the “security” industry as a small part of a much larger war for control of the home. “It just happens that monitoring is the spear tip that these major companies are using to fight for control of the home,” notes Ira Riklis, CEO of COPS.

COPS has extensive experience with signaling from its nearly 4,000 clients, and it is able to monitor the cost of each signal, and can provide prices based on signals.

What we believe may set COPS apart from other monitoring providers is its acceptance of the human element in developing products and services for its clients, at a good price. The company’s employees have been encouraged to suggest services based on their interactions with dealer customers. Additionally, as COPS client base has changed, so too have the ideas for new services generated by the customer- facing employees.

COPS is focused on making sure its employees are engaged. The hiring process is intense, and like its competitors, less than 10% of applicants are hired. It takes six months to move up through the education process to where an employee is fully operational. Employees must continue to be up to a certain level, or they will not be retained, even though the hiring process is intense. As the employees move up, they are evaluated for those specialty service areas in which they are most competent, but it is clear that if they make it through the process, the investment that the company makes in its employees has led to a sensitivity to specific client needs that have brought COPS some of the largest MSOs as well as DIY partners.

Rapid Response

Many observers of the independent monitoring industry likely know that Rapid Response has invested very heavily in infrastructure and technology, far and away above UL and other standards necessary for certain high-end customer certifications. However, what struck us most about Rapid Response was the almost militarily tough and precise means by which it hired and promoted new employees, while following up with a highly employee-directed office and worker ambience (at least for those who work at the Syracuse facility). With a fairly deep well of students graduating from schools such as Syracuse University and Rochester Institute of Technology, the company has an advantage in hiring technology- oriented workers one would not normally expect in its area. The hiring process at Rapid Response is intense, and highly selective, with single-digit percentages making it through the hiring process.

Rapid Response has been in the health care industry for a long time. For example, in 2009, Rapid Response launched the LifeSafety Monitoring Division to serve those who wanted to maintain their independence, knowing they are protected by a dedicated organization, with advanced monitoring technologies, including GPS and fall-detection, as well as specialists (most EMD/EMT certified) who are chosen for their exceptional customer service and comforting manner.

December 2018 31

Physical Security Sector Security Industry Monitor

Without going into the long list of technology and infrastructure investments Rapid Response has made in the last five years, we think it is fair to state that the company far exceeds all licensing requirements to be at the top tier of the industry, and far exceeds the capability demands that even the largest potential clients could ever need to add a professionally monitored option to their existing business, whether it is legacy, MSO, or DIY in nature. The data and power rooms are a showcase for a company of its size. We would estimate some substantial double-digit millions of investment at Rapid Response, which is a lot per current customer. The Syracuse facility includes four digitally controlled Caterpillar diesel generators. Two of them supply 1.2 megawatts of standby power, and they are backed up by separate, independent 1,200- gallon fuel tanks. An additional two generators provide supplemental 1.6 megawatts of secure standby power using independent 3,100-gallon fuel tanks. Additionally, four blue hued “Liebert” 150kVA Uninterrupted Power Supply units, all in the same place, are wired to provide power whenever the street power goes off. It appears that Rapid Response is either preparing for a lot of new business, or its executives have decided to invest for the next 5-10 years right now.

Affiliated Monitoring

Affiliated Monitoring has also changed with its client base, leaning toward a much more technological orientation. The company, like other leaders in the industry, uses relatively modern NIST Special Publication audits. The company, in its presentations to prospective and existing clients, shows exactly where in the technology stack it operates (the various structures of different components/services that make up a software solution). The company navigates the deep, but competitive technology personnel pool available in the New York metropolitan area. Only about 2% of applicants are hired. As a result of the deep pool, the company has been able to take leading, but standard, monitoring operations software and constantly customize it to fit response and customer care demands as its client base shifts toward more sophisticated users. About a quarter of the signals the company takes in are analyzed by software developed through its API program, an important arm of business development and customer service.

The API program has helped Affiliated Monitoring to not only better integrate security services (PERS, video, crash, etc.), but has helped it in its workforce management, forecasting future client needs and flexing the hiring and ongoing education process to accommodate the needs of new customers who are not even yet on board.

The company’s redundant facility is in Houston, and redundancy is checked twice a month, and a full redundancy check is done four times a year.

A significant percentage of Affiliated’s RMR comes from health care and personal emergency monitoring. It sponsors “Catalyst” (one of the largest PERS conferences), and has created application developer interfaces (API’s) for a large group of health care integrations, using the area expertise from a deep number of drug and health care companies in the New York/New Jersey metropolitan area. For example, in 2017, Affiliated unveiled the first of a series of new software releases, “CareAlert: Priority Group Chat,” to enhance communication in an emergency among the protected person’s circle of family and friends. When a PERS user sends an alert and a care specialist begins making calls, CareAlert sends a text message to the user’s loved ones and caregivers simultaneously. Those people simply click on a link contained in the text and it opens up a group chat feature so they can decide on the best way to help their loved one. By clicking on an “on my way” button, one person can let everyone in the group know that they are going to check on the PERS user. CareAlert is supposed to be phone agnostic and will adapt to every PERS provider on a private label basis for those dealers partnering with Affiliated.

32 December 2018

Security Industry Monitor Physical Security Sector

Affiliated, similar to other leading monitoring companies, integrates with the leading video verification platforms, including I-View-Now, SureView’s “Immix,” as well as Alarm.com. The company’s dealer partners have a range of end user customers including Quick-Service national accounts, auto dealerships, financial services, trucking and heavy equipment yards, government facilities, as well as big box retailers. The company has also developed a consultative approach to its partner relationships, with a dedicated team in analytics technology, in that its dealer partners will frequently bring it into meetings with end users, including “stand-up” meetings. The company provides a host of mobile and web tools on its dealer portal, including API’s, messaging applications, wide range of customer “success” apps, and a wide range of IoT/device integration help from mobile PERS to advanced geofencing.

Reducing False Alarms and Speeding Up Response Through Automated Signaling. Now What Do We Do with Verification?

Ever since the development of the digital dialer in the 1990s, the number of security installations has grown from commercial and “carriage trade” residences, to a mass market encompassing over 20% of homes in the U.S. Unfortunately, along with that growth has come a coincident growth in the number of false alarms that has stretched budgets and time management for both law enforcement and health care operators. Whether the high rate of false alarms is due to user errors (most common), or poor alarm- validation procedures, or equipment failure, what is certain is that police and community relations work done by small and large monitoring companies to explain how to better deal with false alarms, has not stopped an increasing number of cities from instituting sanctions that penalize the end user and/or the monitoring company for false alarms. The monitoring industry’s value proposition is thus under pressure from those that believe that the industry either does not care about, or is incompetent in significantly reducing false alarms. This is before considering what will happen with the new surge in technology, MSO, and DIY company entrants, all adding devices to the home and small business, which we believe will greatly increase the number of available monitored (and unmonitored) systems.

However, without real improvements in both verification and notification technologies, we can see the response time and municipal fine problem getting worse as the industry braces for another spurt in growth from these newer MSO, big technology, and DIY entrants. Some of these users, particularly younger and newer entrants, will initially bypass monitoring altogether, preferring to deal directly with the 911 network, further complicating an already confusing situation. How large could this problem become?

Growing penetration rates will likely make the false alarm problem worse. Based on our research, we continue to see a rapidly expanding market for premises automation, including Internet of Things services, for both residential and commercial applications. With a growing number of companies and new devices entering the category, technology and end-user satisfaction will increasingly define this market and enable the more than 12,000 independent security dealers in the U.S. to participate in the smart home and business opportunity at some level.

As such, we estimate the total available U.S. market for fee-based security systems/devices at nearly 50 million homes by year-end 2024, compared with an estimated 22.7 million homes in 2017. We estimate the revenue potential to reach $62 billion by year-end 2024, compared with an estimated $26 billion by year-end 2017. Ultimately, we estimate that the penetration rate for total fee-based security systems (both integrated security and DIY solutions) was 22.7% in 2017 and could increase to 29.6% by 2020 and then to 42.0% by 2024. See our December 2017 Premises Control and Automation: Outlook for 2017-2024 white paper.

December 2018 33

Physical Security Sector Security Industry Monitor

The revenue potential for the U.S. market for fee-based security systems/devices could vary materially, depending on how many newly developed apps are being sold. We continue to believe the market is large enough to allow a multitude of home solution providers to successfully compete: from the highly customizable home solutions provided by Crestron, Savant, and Control4, to ADT Corp., Vivint, and Verisure, as well as select DIY products that have a strong reputation and brand following, such as Ring Wi-Fi Enabled Video Doorbell. However, we believe this will be of little help to end users who still want quick response and a sense of safety in addition to having the ability to adjust home controls, if growing false alarms put a damper on response timing, while increasing fines for each false alarm.

However, there are already consequences to an accelerating penetration of homes presently. More and more communities and police departments are beginning to “score” response to calls for help based on who they trusted in the past, whether there is a verification of the threat, and how complicated the threat is to interpret by the 911 operators. We wonder how much of the estimated market growth will be at risk if each of the new 25 million homes we estimate being added by 2024 adds even just one false alarm per year. (The current average according to The Monitoring Association [TMA] is 1.7 per year.) All one has to do is search for “false alarm ordinances” on the internet to see the scores of cities that have tried and will continue to try to limit quick response to unverified alarms, and to financially punish those who are blamed for poor alarm history.

Some sobering results came out of our survey report dated June 12, 2018 on 500 police and health care responders. The conclusions of the survey were that police were far more likely to provide an earlier response (nearly 5x more likely) to a verified call from a professionally monitored system than from a verified call from a DIY caller. Health care responders were more than 5x more likely to respond first to a professionally monitored call than from a DIY initiated call. However, when the call was not verified, the likelihood of response became much closer; Survey comments indicated that once a call was flagged as unverified, the focus for quick response faded, regardless of the source of the call.

Based on the above, we can only conclude that time is running short for the entire alarm and home automation industry from professional monitoring companies to simple phone-based DIY systems to provide verifiable, understandable, and accurate “actionable” data to responder organizations in order to protect all their value propositions, ranging from safety and security to simple conveniences of the connected home.

34 December 2018

Security Industry Monitor Physical Security Sector

Solutions in the Works

The good news is that cities tend to respond to verified and trusted sources of dispatch signals. Fortunately, there is not a lack of initiative and long-developing programs and technologies to help monitoring companies to increase or regain the trust of communities and responder organizations with regard to reducing false alarms, and improving data accuracy.

In our opinion, a great example is Sonitrol Inc. (purchased by Stanley Black & Decker in 2008). Sonitrol has been in business for 55 years, with a proprietary audio incident verification solution, and can document 7- 8 minutes average police response (6-7x faster than residential unverified) which claims and advertises 179,000 apprehensions as a result of quick response to its dispatch calls. Sonitrol is sold mainly to educational and commercial enterprises, and is relatively expensive – probably too expensive for the mass and DIY market today. Even so, Sonitrol continues to grow. However, the company uses proprietary software and is not integrated well with other systems in the alarm monitoring center (it is run as a separate monitoring area inside the monitoring center), but we cite Sonitrol as an example because its solutions offer some proof that police will respond quickly to trusted, verified sources.

Other companies with sophisticated monitoring and responder communications capabilities for enterprises, such as ADT Inc., Securitas Electronic Security, Interface Security, Johnson Controls, Stanley Black & Decker, AlliedUniversal, and G4S have expensive analytics and machine learning capabilities in video and access control – and internal or contracted security professionals (guards) to verify that an incident demands a professional response.

There are increasingly strong new entrants in the verification business that have the technology to address the problem for verification.

The first example is I-View Now, which is increasingly utilized by the security industry’s leading providers for video and signaling solutions. I-View Now integrates security system signals, video sources, cloud applications, and internet-connected devices into a cloud platform with the objective of giving end users, operators, and authorized emergency responders better information to prioritize their resources. Their cloud architecture and Software as a Service (SaaS) model means there is no additional software or hardware to purchase at the edge, in the monitoring center, or for the emergency responders. Unifying these technologies and constituencies results in fewer false alarms and faster response times.

Another strong participant is SureView Systems. SureView owns, develops, sells, and supports the Immix product line. Immix is a video centric software platform designed to receive alarm events from video, video analytics, access control, automation platforms, and situational awareness systems.

And then there is Alarm.com (ALRM), the leading platform for the intelligently connected property, a fully integrated, smarter security solution. Alarm.com combines intelligent intrusion detection, video surveillance, and access control into a single solution.

December 2018 35

Physical Security Sector Security Industry Monitor

ASAP-to-PSAP Program: Turning the PSAP’s “Most Feared Call to Answer” into “its Best”

Beginning in 2004, several organizations, led by the Association of Public Safety Communications Officials (APCO), which is the world’s largest organization of public safety communications professionals), joined by the Central Station Alarm Association (now called The Monitoring Association, or TMA), began work on a project to modernize the outdated alarm monitoring-to-911 process. They developed a standard in 2009 and an application in 2009 (that included communicating over Nlets). Their joint work created the “ASAP” protocol, which, in 2011, was developed into the ASAP-to-PSAP protocol.

ASAP, or Automated Secure Alarm Protocol program is a computer-aided dispatch system. The ASAP is intended to be a national service that is the next generation for the processing of information from alarm monitoring stations needing emergency dispatch. ASAP is designed to increase the accuracy and efficiency of calls for service from alarm companies to Public Safety Answering Points (PSAPs) by replacing a phone call with a digital message over the Nlets network. Nlets is the leading 50-state justice and public safety network in the U.S. Nlets, is a private not for profit corporation owned and funded by the U.S.

The ASAP to PSAP programs seeks to modernize the old legacy protocols for response off of alarms: The realities of human interaction, mistakes in understanding addresses, situations, timing, led to the security call being considered the hardest situation to deal with in the PSAP centers, along with the fact that there was so many of them – about 10-20% of all the calls the PSAP had to accommodate.

The ASAP-to-PSAP Protocol aims to:

1) Eliminate or drastically reduce the number of telephone calls between the alarm monitoring company and the 911 call takers

2) Eliminate verbal communications and miscommunication between the monitoring company operators and the 911 call takers

3) Decrease processing and response times to alarm-related calls for service with the objective of an increase in law enforcement apprehensions

The ASAP service modernizes the PSAP call for service process from alarm companies, significantly reducing PSAP staff handling time. Once an alarm operator determines that an event must be handed off to 911, the new alarm event is electronically sent from the alarm monitoring company over a secure, dedicated network to the designate 911 center for the dispatch of public safety or health resources. There are many requirements for what data must be sent, how the PSAP must respond to the ASAP, and who or what is responsible for the process. If the PSAP’s Computer Aided Dispatch (CAD) system accepts the incident as valid, it communicates the information to the PSAP’s dispatcher. The process cuts out monitoring center personnel having to interact by a telephone call with the PSAPs personnel.

36 December 2018

Security Industry Monitor Physical Security Sector

We have been monitoring data as far back as 2011, when some 5,900 PSAPs (now up to 6,500) were taking in 250 million calls made to 911. Of those 23 million were alarm notifications to facilitate the dispatch of safety responders. PSAPs then route the information from 911 calls to the right emergency service and then dispatch police or fire services.

Security Sales & Integration, a leading industry publication, noted in its November 8, 2018 edition:

“As an example of a jurisdiction experiencing success, just over a year ago Hamilton County, Tenn., became the first PSAP in the state to go live with the ASAP service. Hamilton County has recently provided efficiency metrics (Source: Tri-tech Software Systems) that will intrigue any PSAP director:

° 30 seconds total of call taker/dispatcher time on an alarm incident vs. four minutes on average prior to implementation of the ASAP service

° average of 30 minutes a day spent on alarm incidents vs. 2.5 hours on average prior to ASAP

° 184 staff hours/23 shifts (8-hour shifts) per year vs. 920 hours/115 shifts per year prior to ASAP”

The IJIS Public Safety Standards Technical Committee in in November 2017 Case Study Report, described similar improvements in other cities, such as Houston, Texas, Washington D.C., James County, Virginia, and Boca Raton, Florida. The progress of the programs was updated at the 2016 ASIS industry conference.

Vector Security (whose president chaired the alarm industry’s delegation) has rolled out its own enhanced versions of this technology. Brinks Home Security’s (BHS) ASAPer has the capacity to alert both its customers and their emergency contacts “as soon as possible” when an alarm goes off. According to BHS, ASAPer is unique in its collaborative, interactive messaging hub interface that allows multiple users to connect with one another via text and email to coordinate a response. ADT rolled out its ASAP-to-PSAP program in 2015.

As of September 2018, The Monitoring Association and the Industry Council for Emergency Response Technologies (iCERT) had counted in its ASAP/PSAP deployment summary:

° Over 35 security companies comprising 22 Monitoring Centers

° 41 PSAPS connected

° 20 PSAPs in progress

° 21 PSAPs with LOI

° 16 states either using or ready for ASAP production

° California as its own “special situation”

° 22 states as either being configured or ready to be configured for ASAP production

° 6 states (including New Jersey and Connecticut) with no plan at this point

December 2018 37

Physical Security Sector Security Industry Monitor

The iCERT was co-founded by R. Kevin Murray, the founder of Mission Critical Partners (MCP). MCP is a professional services and co-managed and IT services firm that helps clients enhance and evolve their public safety systems and operations through extensive experience, knowledge, and resources. MCP has been one of the organizations on the PSAP side of the equation working in partnership with the alarm industry to strongly promote the adoption of ASAP to PSAP.

Many Challenges Still Remain for Reducing False Alarms Despite the ASAP-to-PSAP Advance

1) ASAP-to-PSAP does not address verification of the initial incident. It is still up to the security provider to develop technologies that will not only verify that an anomaly or a threat exists, but one that will meet the ASAP-to-PSAP protocol standards, so as to not be rejected by the PSAP as a priority dispatch. Ferreting out what types of verification will be accepted such as guards, image sensors, straight video, video analytics software, identity solutions systems, audio technology, proximity technology, and from professional versus DIY systems, etc. is still something that must be standardized.

2) Location accuracy from mobile phones. The PSAPs still do not have the ability to accurately locate cell phones calling in emergencies on the scale that they can with POTS lines. This was not such a problem 15 years ago. It is now.

3) Funding. While one of the chief advantages for the PSAPs is that the protocol requires very little new funds from them, that is not the situation for the security industry. Most security companies will have to upgrade to 4G from 3G communications, and many will have to upgrade their monitoring center software. The cost of the upgrades will likely fall disproportionally on the top 20 or 30 companies in the industry rather than on DIY product companies, small alarm dealers, or the large technology providers that may not seem to prioritize security. It may be true what proponents in the security industry claim: that the savings in reduced false alarms and less time per incident can easily more than pay for the investment in ASAP-to-PSAP. However, we still see major participants in the industry – including the independent monitoring companies – not having adopted or having an LOI to sign up for the program, even if it is a far better alternative to the company-by-company mess we now have.

4) New complementary technologies may be viewed as competitive technologies that could cause confusion and slow down adoption of verified response systems/protocols.

As ASAP-to-PSAP continued to develop, the years have gone by and new technologies have emerged that could complement or compete with this approach.

For example, our survey of 500 responder organizations found that while the PSAPs were extremely happy with the timeliness and accuracy of the information they were receiving from the monitoring centers, the responders still wanted more video data, more information about the original end users, really any kind of data that could help them “score” and prioritize the incident situation. Responders were particularly suspicious of data that originated with DIY equipment and their end users, and far more confident with data that came from a professional monitoring center, regardless of whether the original end user was commercial/industrial or residential

38 December 2018

Security Industry Monitor Physical Security Sector

For example, some of the communications challenges faced by ASAP/PSAP adopter in using the Nlets network, might be solved by also using, or substituting First Net, authorized by Congress in 2012 as a nationwide broadband network for everything from smartphones to tablets, In-vehicle routers (IVR), and a wide variety of specialty devices.

Another example at the other extreme is privately held, venture capital funded RapidSOS, which believes it has the technology to accurately locate cell phone callers. If this is true, we wonder if the technology is complementary to or competitive with the ASAP/PSAP program. RapidSOS is just one of several companies, some with very different technologies that are working on providing PSAPs and responders with the most accurate location and situational data for use directly to the PSAP.

There are also the issues of video and audio verification, apart from location. Honeywell, Resideo, SmartView, I-view Now, Alarm.com, SureView, Brivo and Eagle Eye networks, Allegion and Assa Abloy, and West Company do not presently have video or access analytics offerings that can be afforded by residential users on a mass market basis. We only mention this because we would advise some urgency behind these efforts. We would like to see a major adopter legitimize new verification and data technologies to help accelerate adoption by all parties and provide a solution before EMS, police, and fire responders further slow their responses to alarms and city councils further increase their fines.

December 2018 39

Physical Security Sector Security Industry Monitor

M&A Review and Outlook

° M&A activity in the Physical Security sector stayed steady in the first three quarters of 2018, continuing a trend started in the latter half of 2016

With the convergence of IT and Physical Security and the intersection of defense and security continuing to drive value in the Physical Security sector, transaction volume trended upward through 2011. M&A activity in 2012 moderated in the physical security sector, which corresponds to the overall slowdown in M&A activity resulting from the European Credit Crisis and the Fiscal Cliff in the U.S. There was slow M&A activity in 1H13 because the valuations went up, but buyers became much more active in the second portion of the year. Activity slowed slightly in 1H14, but trended upwards for the rest of 2014. After continued deceleration in 2015 and in 1H16, there was a sharp reversal, with volumes shooting higher in the latter half of 2016, riding the overall optimism of the bull market. Optimism remained high in the aftermath of the presidential election, buoying stock prices and valuations across the board.

Figure 14: M&A Transactions in the Physical Security Sector, 3Q13 to 3Q18

45

40 39

35 32 33 29 29 30 30 28 27 25 26 25 23 23 21 20 20 19 20 16 16 15 15 15 9 10

5

- Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 2013 2013 2014 2014 2014 2014 2015 2015 2015 2015 2016 2016 2016 2016 2017 2017 2017 2017 2018 2018 2018 Physical Security Services Physical Security Products Sources: Imperial Capital, LLC and Capital IQ.

Notable Middle Market Transactions The market for M&A in the first three quarters of 2018 was consistent with the first the first three quarters of 2017.

° Ares Private Equity Group acquired Convergint Technologies LLC for an undisclosed amount

On February 2, 2018, Ares Private Equity Group acquired Convergint Technologies LLC, an integrator of electronic security, fire alarm and life safety, and solutions.

40 December 2018

Security Industry Monitor Physical Security Sector

° Nortek Security & Control, LLC acquired IntelliVision Corp. for an undisclosed amount

On May 9, 2018, Nortek Security & Control, LLC acquired IntelliVision Corp., a provider of video analytics, video content analysis, and automated surveillance solutions.

° Canon Inc. acquired BriefCam Ltd. for an undisclosed amount

On May 9, 2018, Canon Inc. acquired BriefCam Ltd., a provider of systems for reviewing analyzing, and indexing of surveillance camera content.

° The Brink’s Company acquired Dunbar Armored, Inc. for $519.8 million

On May 31, 2018, The Brink’s Company acquired Dunbar Armored, Inc., a provider of cash management, logistics, and loss prevention solutions worldwide.

° Allied Universal acquired U.S. Security Associates, Inc. for $1 billion

On July 16, 2018, Allied Universal acquired U.S. Security Associates, Inc., a provider of uniformed security services.

° Best Buy Co., Inc. acquired GreatCall, Inc. for $800 million

On August 15, 2018, Best Buy Co., Inc. acquired GreatCall, Inc., a provider of a personal emergency response system.

° Hellman & Friedman LLC acquired SimpliSafe, Inc. for an undisclosed amount

On August 15, 2018, Hellman & Friedman LLC acquired SimpliSafe, Inc., a provider of wireless systems, cameras, and monitoring services.

° Amazon.com, Inc. acquired Ring, Inc. for $993 million

On February 27, 2018, Amazon.com, Inc. acquired Ring, Inc., a manufacturer of video doorbells for homes.

° Prosegur Compañía de Seguridad, S.A. acquired G4S Cash Solutions Colombia Ltda for an undisclosed amount

On June 4, 2018, Prosegur Compañía de Seguridad, S.A. acquired G4S Cash Solutions Colombia Ltda, a provider of surveillance and private security systems.

° ADT, Inc. acquired Red Hawk Fire & Security, LLC for $318 million

On October 25, 2018, ADT, Inc. acquired Red Hawk Fire & Security, LLC, a provider of life safety and security systems.

December 2018 41

Physical Security Sector Security Industry Monitor

° UTC Climate, Controls & Security acquired S2 Security Corporation for an undisclosed amount

On September 20, 2018, UTC Climate, Controls & Security acquired S2 Security Corporation, a manufacturer of physical security and video management systems.

° Securitas Electronic Security, Inc. acquired Kratos Public Safety & Security Solutions, Inc. for $69 million

On February 28, 2018, Securitas Electronic Security, Inc. acquired Kratos Public Safety & Security Solutions, Inc., a provider of national security services.

° Garda World Security Corporation acquired United American Security, LLC. for $72 million

On March 9, 2018, Garda World Security Corporation acquired United American Security, LLC, a provider of security guards and guard services.

° BCE, Inc. acquired AlarmForce Industries, Inc. for $72 million

On January 5, 2018, BCE, Inc. acquired AlarmForce Industries, Inc., an integrated security alarm company.

Registered Direct and Private Placement Snapshot

The Physical Security sector experienced a significant increase in private placements during the first three quarters of 2018 compared to the first three quarters of 2017.

° Owl Cameras, Inc. received $28.5 million in a Series A round

On February 2, 2018, Owl Cameras, Inc., which develops and manufactures security cameras for cars, raised $28.5 million in a Series A round led by Defy Partners.

° Airspace Systems, Inc. received $20 million in a Series A round

On March 3, 2018, Airspace Systems Inc., a provider of drone security solutions raised $20 million in a Series A round led by Shasta Ventures and Granite Hill Capital Partners.

° Openpath, Inc. received $7 million in a Seed round

On May 22, 2018, Openpath Inc., which offers security solutions for the office received $7 million in a Seed round that included participation from Upfront Ventures, Pritzker Group Venture Capital, Fika Ventures, Sorenson Ventures, and Rincon Venture Partners.

42 December 2018

Security Industry Monitor Physical Security Sector

Public and Rule 144A Debt and Equity Offering Snapshot

Public offerings in the Physical Security sector in the first three quarters of 2018 were in line with the first three quarters of 2017.

° Assa Abloy raised $58.7 million of debt

On April 19, 2018, Assa Abloy raised $58.7 million in Senior Bonds. The company provides door opening solutions.

° SPS Holdings, Inc. raised $117 million of debt

On June 26, 2018, SPS Holdings, Inc. raised $117 million on debt. The company provides security installation, monitoring, and related services.

° Fortune Brands Home & Security, Inc. raised $600 million of debt

On September 19, 2018, Fortune Brands Home & Security, Inc. raised $600 million of senior unsecured notes. The company is a provider of home security products.

Bankruptcies

There were more Physical Security Solutions bankruptcies that occurred in the first three months of 2018 than the same period the year prior.

° Initial Protective Services, Inc. filed for bankruptcy in 1Q18

On January 3, 2018, Initial Protective Services, Inc. filed a voluntary petition for reorganization under Chapter 11 in the US Bankruptcy Court for the District of New Jersey. Initial Protective Services, Inc. operates as a security agency providing security and protection services.

December 2018 43

Physical Security Sector Security Industry Monitor

Notable Transactions

Figure 15: Select M&A Transactions in the Physical Security Sector, 3Q16 Through 3Q18 Announced Target TEV / TEV / / Filing Closed Date Target Business Description Buyer Implied TEV Revenue EBITDA Date ($mm)

9/22/2016 10/26/2016 Neo S Netw orks Neo S Netw orks offers security and guard services. SK Telink Co., Ltd. $7,213.9 0.8x NA

Point Grey Research Inc. designs and manufactures digital cameras for FLIR Integrated Imaging 10/1/2016 11/4/2016 Point Grey Research Inc. industrial, medical and life science, traffic, biometric, GIS, and people counting $252.5 NA NA Solutions, Inc. applications.

FJC Security Services, Inc. provides security services to private and public 10/3/2016 10/3/2016 FJC Security Services, Inc. Allied Universal NA NA NA sector clients in the United States.

Hashmira Company Limited, through its subsidiaries, provides security and First Israel Mezzanine 12/2/2016 12/2/2016 Hashmira Company Limited $111.8 NA NA guarding services in Israel. Investors Ltd.

Stanley Black & Decker, Inc., As of February 22, 2017, Certain Mechanical Security Businesses of Stanley 12/21/2016 2/22/2017 Certain Mechanical Security dormakaba Holding AG $725.0 NA NA Black & Decker, Inc. w as acquired by dormakaba Holding AG. Businesses

Meggitt Defence Systems QinetiQ Target Systems Limited represents the combined operations of Limited and Meggitt Holdings 12/21/2016 12/21/2016 Meggitt Defence Systems Limited and Meggitt Holdings Canada Inc. in their QinetiQ Group plc $71.0 2.2x 11.7x Canada Inc. (nka:QinetiQ sale to QinetiQ Group Plc. Target Systems Limited) G4S Utility Services represents the combined operations of G4S Utility and Outsourcing Services (UK) Limited, G4S Assessment Services (UK) Limited, First Reserve 12/28/2016 12/28/2016 G4S Utility Services $63.6 NA NA and G4S Locks & Alarms (UK) Limited in their sale to FRC Founders Corporation Corporation.

Costar Video Systems, 12/29/2016 12/29/2016 Innotech Security, Inc. Innotech Security, Inc. designs, manufactures, and sells security products. $15.5 1.9x NA LLC

FluxData, Inc. develops and manufactures multispectral and polarimetric 1/9/2017 1/9/2017 FluxData, Inc. imaging systems for aerospace, defense, industrial, medical, and scientific Halma plc $27.5 5.3x NA markets.

1/27/2017 1/27/2017 Cobelguard NV Cobelguard NV provides security services. Loomis AB (publ) $18.2 1.4x NA

Rauland-Borg Corporation designs, manufactures, sells, and services 2/7/2017 2/7/2017 Rauland-Borg Corporation communication and life-safety equipment for education and healthcare AMETEK, Inc. $370.0 2.3x NA industries.

Package Concierge, Inc. manufactures electronic locker systems in the United 2/28/2017 2/28/2017 Package Concierge, Inc. Gibraltar Industries, Inc. $20.0 NA NA States.

Airbus Defence and 4/7/2017 5/31/2017 Cassidian SAS Cassidian SAS develops and manufactures security solutions and systems. $14.8 NA NA Space GmbH

10% of Westcon Emerging As of September 1, 2017, 10% of Westcon Emerging Markets Group (Pty) Ltd Markets Group (Pty) Ltd and 6/5/2017 9/1/2017 and 10% of Westcon Group European Holdings, Limited w as acquired by SYNNEX Corporation $30.0 NA NA 10% of Westcon Group SYNNEX Corporation. European Holdings, Limited As of June 20, 2017, US Subscription Base of AlarmForce Industries Inc. w as AlarmForce Industries Inc., US acquired by Select Security, Inc. US Subscription Base of AlarmForce Kourt Security Partners, 6/14/2017 6/20/2017 $11.6 NA NA Subscription Base Industries Inc. comprises security alarm and personal emergency response LLC monitoring business operations.

ipDatatel, LLC designs and engineers innovative cellular and Internet alarm 9/6/2017 9/6/2017 ipDatatel, LLC Resolution Products - NA NA communication devices for the security and home automation industries.

SDI Presence LLC, an information technology (IT) and security systems Integrated Security System 9/18/2017 9/18/2017 integrator, develops, installs, and manages technologies for large Convergint Technologies - NA NA division of SDI Presence LLC organizations and government agencies.

44 December 2018

Security Industry Monitor Physical Security Sector

Announced Target TEV / TEV / / Filing Closed Date Target Business Description Buyer Implied TEV Revenue EBITDA Date ($mm)

Mercury Security is a leading OEM supplier of controllers for physical access 9/20/2017 9/20/2017 Mercury Security HID Global - NA NA control.

Protec, Inc. provides commercial and institutional electronic security, fire, and The ADT Security 7/31/2017 7/31/2017 Protec, Inc. NA NA NA video system. Corporation

Nelco Limited, ISSS and VSAT business comprises security and surveillance Nelco Limited, ISSS and VSAT Nelco Netw ork Products 9/1/2017 9/1/2017 solutions business and hardw are business and netw ork management $4.1 NA NA business Ltd. services.

AlarmForce Industries Inc., an integrated security alarm company, provides security alarm monitoring, personal emergency response monitoring, video 11/6/2017 1/5/2018 AlarmForce Industries Inc. BCE Inc. $143.4 3.2x 12.0x surveillance, and related services to subscribers in Canada and the United States.

Butterfleye, Inc. designs and develops cameras and monitoring systems used 12/20/2017 12/20/2017 Butterfleye, Inc. Ooma, Inc. NA NA NA for home and office security.

Diversified Protection Diversified Protection Systems, Inc. designs, constructs, and maintains fire, Red Haw k Fire & 1/16/2018 1/16/2018 Systems, Inc. and ATCi air, and electrical systems for critical facilities, production controls, and high NA NA NA Security, LLC Communications, Inc. asset value areas.

Byggsikkerhet AS distributes security systems and solutions including fire alarms, anti-theft alarms, television surveillance, fire doors, and safety 1/22/2018 1/22/2018 Byggsikkerhet AS Låssenteret AS NA NA NA markings in addition to fire control, electrical control and el thermography in residential, commercial, and agricultural areas.

Chamberlain Security manufactures security components to protect the Rankin Industries Inc.; 2/26/2018 2/26/2018 Chamberlain Security NA NA NA contents of safes, filing cabinets, and ATMs. Broco, Inc

Unmanned Security Business Unmanned Security Business of SG Safety Solutions Co., Ltd. comprises a 4/9/2018 5/31/2018 of SG Safety Solutions Co., business that provides unmanned security dispatch services and security KT Telecop Corporation $25.5 1.4x NA Ltd. consulting services.

Netw atch Ireland Limited 4/23/2018 4/23/2018 Netw atch Group provides remote CCTV security camera monitoring services. The Riverside Company NA NA NA (nka:Netw atch Group)

IntelliVision Corp. develops and sells intelligent video analytics, video content Nortek Security & 5/9/2018 5/9/2018 IntelliVision Corp. NA NA NA analysis, and automated surveillance solutions. Control, LLC

U.S. Security Associates, Inc. provides uniformed security services, 7/16/2018 10/26/2018 U.S. Security Associates, Inc. consulting and investigations, and specialized security solutions in the United Allied Universal $1,000.0 NA 10.5x States and internationally.

Systems By Design, Inc. manufactures home security solutions that include 7/19/2018 7/19/2018 Systems By Design, Inc. ADS Security, L.P. NA NA NA home burglar, business burglar, and fire alarms.

Access Control Technologies, Inc. distributes security and access control Access Control Technologies, Convergint Technologies 8/2/2018 8/2/2018 systems for customers in New York, New Jersey, Connecticut, Delaw are, NA NA NA Inc. LLC and Eastern Pennsylvania.

Sources: Capital IQ and Imperial Capital, LLC.

December 2018 45

Physical Security Sector Security Industry Monitor

[This page intentionally left blank.]

46 December 2018

Consumer Industry Monitor Executive Summary

Section III

Identity Solutions Sector

December 2018 47

Information Security Sector Security Industry Monitor

[This page intentionally left blank.]

48 December 2018

Security Industry Monitor Identity Solutions Sector

Identity Solutions Sector Sector Outlook and Commentary

Within the identity solutions security sector, we highlight a range of counterfeiting and grey market scams. We bring attention to the products and services that will be required to authenticate and show provenance for areas with newly legalized cannabis use. Making sure medical marijuana being sold is what it says it is and is grown where it says it is grown will likely be a key challenge as the industry growth accelerates.

Counterfeiting Losses Continue to Grow Worldwide: Counterfeiting Report

On May 15, 2018, the Global Brand Counterfeiting Report, published by market consultant, R Strategic Global, noted that the amount of total counterfeiting globally reached $1.2 trillion in 2017 and is predicted to reach $1.82 trillion by the year 2020 (CAGR of 15%), which includes “counterfeiting of all equipment/products from defense equipment to counterfeiting of watches.” The estimated losses due to counterfeiting of high end consumer goods amounted to $98 billion, which includes counterfeiting from offline as well as online mediums.

According to the analysis made in the report, losses incurred by Luxury Brands because of sale of counterfeiting through internet accounted to $30.3 billion.

The report adds that it estimates that the losses suffered due to online counterfeiting globally amounted to $323 billion in the year 2017.

Historic New York City Counterfeit Bust: Wide Range of Goods Worth $450 million

On September 17, 2018, WABC News reported nearly two dozen people were arrested in what authorities are calling one of the largest counterfeit goods takedown in New York City's history, worth about $450 million.

Agents from Homeland Security Investigations and the NYPD shut down an alleged luxury counterfeit goods operation with 22 suspects accused of illegally bringing Chinese-manufactured goods worth millions of dollars into the United States by smuggling them through ports of entry on the East and West coasts.

The counterfeit goods included items such as fake Louis Vuitton and Tory Burch handbags, Michael Kors wallets, Hermès belts and Chanel perfume.

As a result, the government restrained nine properties in Queens, Staten Island, and Brooklyn belonging to the defendants.

According to the court filings, the suspects played various roles in the trafficking of counterfeit goods manufactured in China. Brought by ocean-going ships to the U.S. in 40-foot shipping containers, the goods were smuggled through ports of entry disguised as legitimate imports and distributed throughout the country.

December 2018 49

Identity Solutions Sector Security Industry Monitor

DNA Innovation in Textiles Anti-Counterfeiting Technology

Results of a new study published in the September/October 2018 issue of the American Association of Textile Chemists and Colorists’ AATCC Review have concluded that DNA molecular tagging is a highly effective tool to authenticate denim, while maintaining its integrity even after exposed to the rigors of bleaching and abrasion. The study was conducted by Applied DNA Sciences Inc. and the Fashion Institute of Technology (FIT). At the FIT labs in New York, denim swatches were treated with unique DNA molecular tags produced by Applied DNA, then subjected to stone and bleach washings. The samples were then analyzed at Applied DNA’s laboratories in Stony Brook, where it was proven that the DNA tags remained intact and suitable for high quality forensic scale analysis. Based on the observed stability, DNA tags of this kind may soon be ready for testing at a full manufacturing facility to verify the authenticity of the finished denim garment, Applied DNA reports.

"This technology will enable brands and manufacturers to track their fibers from the farm through to the finished product, allowing for a more transparent supply chain. Traceability can also help verify certain sustainability claims about commodities and products, helping ensure good practices and respect for people and the environment in supply chains," said Sean Cormier, FIT Assistant Professor, Textile Development and Manufacturing.

The denim authentication problem is significant because most American cotton, including Upland cotton used to produce denim, is shipped overseas and combined with other cotton where it can lose its identity.

Chinese Police Make the Largest Counterfeit Bust in the Country

On January 17, 2018, The China Daily News reported that fake bank notes with a total face value of more than 214 million yuan ($33.2 million) were seized after police in Guangdong province busted a prolific counterfeiting gang.

Police seized the fake bank notes after cracking the biggest counterfeiting case in the nation's modern history late last year, a senior police official said.

"The case is regarded by the Ministry of Public Security as the country's largest counterfeiting case since the founding of New China in 1949," said deputy director-general Lin Weixiong of the Guangdong Provincial Department of Public Security at a news conference on Tuesday in Guangzhou, the provincial capital.

Bad Air Jordans

On August 8, 2018, U.S.A. Today reported that five people had been charged in New York with trafficking in 380,000 pairs of counterfeit Nike Air Jordans, sneakers that, if authentic, would have been worth $73 million, according to the NYPD and Homeland Security Investigations.

The counterfeit sneakers looked like real Air Jordans in design and color but lacked the logos that are registered trademarks, court records said.

50 December 2018

Security Industry Monitor Identity Solutions Sector

After the fakes arrived at the Port of Newark from China, they were taken to locations in Brooklyn and Queens where the logos were added and then distributed for sale, according to NYPD and HSI investigators.

Ovwe the last two years, the counterfeiting ring shipped 42 containers full of these generic sneakers that would retail for $190 per pair, court records said.

Canadian Drug Firm Admits Selling Counterfeit and Misbranded Prescription Drugs Throughout the United States

On July 20, 2018, Forbes reported that Kristjan Thorkelson, a resident of Manitoba, Canada, together with several Canadian companies associated with Thorkelson, including Canada Drugs, Rockley Ventures, and River East Supplies, admitted today to widespread illegal sales of misbranded and counterfeit prescription drugs in the United States.

Chief U.S. District Court Judge Dana Christensen sentenced the Canadian companies to forfeit $29 million of the proceeds of their illegal scheme, to pay a fine of $5 million, and to five years of probation. Thorkelson and the associated companies were also ordered to permanently cease their operations, surrender to the United States all domain names and websites from their businesses, and cooperate with the United States Justice Department and the Food and Drug Administration (FDA) in any further criminal investigations.

Labs Warn of Dangerous, Contaminated Pot at Dispensaries

On April 20, 2018, WABC News reported that, as of that date, California State Bureau of Cannabis stated there were only 57 labs statewide to test millions of pounds of marijuana and they cannot test it all yet, which means much of the marijuana on shelves has not met state standards that went into effect over the following few months.

According to the Cannabis Industry Association, just 5% percent of cannabis products for sale in the state of California are tested for safety. In addition, some experts believe as much as half of the marijuana being grown is contaminated with potentially dangerous chemicals or bacteria.

"Pesticides are one of the things, but there are a variety of pathogenic molds and fungus that can also grow on cannabis. It can be dangerous to human beings, especially people who have compromised immune systems," said Steve DeAngelo, who founded the nation's first pot safety testing lab, called Steep Hill in Berkeley, California. “Up until recently, pot agriculture has been unregulated. California now requires testing for 66 pesticides, harmful chemicals, and dangerous fungi.”

“Pretty bad growing on a plate, can you imagine what it would look like growing in your lungs?" he added.

Unfortunately, the WABC report notes, “We may know what such an infection would look like. Doctors at U.C. Davis Medical Center in Sacramento believe a cancer patient died from a rare fungal infection last February. Researchers were able to trace the illness back to the pot that was supposed to make the patient feel better.”

December 2018 51

Identity Solutions Sector Security Industry Monitor

DNA Testing for Cannabis Authenticity and Provenance

On August 1, 2018, TheraCann International Benchmark Corporation, a full service international cannabis business and facilities project planning, services, and consultant firm, in conjunction with Applied DNA Sciences, Inc., a leader in molecular technologies for supply chain transparency, announced the launch of ETCH biotrace™ technology. The molecular "tag and trace" system will be included with TheraCann's licensing, project management, security, cultivation, and analysis services. TheraCann's platform anticipates the cannabis regulatory environment by adding capabilities that allow for the forensic tracking of cannabis and cannabis derivatives across the supply chain. Applied DNA Sciences will provide the forensic tagging, testing, tracking and provenance for the service.

52 December 2018

Security Industry Monitor Identity Solutions Sector

M&A Review and Outlook

° Identity Solutions product and service companies experienced starkly different M&A activity during the second and third quarters of 2018. In 2Q18, there was no identity solution M&A activity and very little identity solution product M&A activity.

The Identity Solutions sector’s M&A activity significantly spiked following the end of 2Q18.

Figure 16: M&A Transactions in the Identity Solutions Sector, 3Q13 to 3Q18

20 18 16 14 12 10 8 6 4 2 - Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 2013 2013 2014 2014 2014 2014 2015 2015 2015 2015 2016 2016 2016 2016 2017 2017 2017 2017 2018 2018 2018

Identity Solutions Services Identity Solutions Products

Sources: Imperial Capital, LLC and Capital IQ.

Notable Middle Market Transactions

Transaction activity in the Identity Solutions Sector has picked up in the third quarter of 2018 with an emphasis on Identity Solutions Services.

° ams AG acquires KeyLemon S.A. for an undisclosed amount

On February 6, 2018, ams AG acquired KeyLemon S.A., a provider of biometric identification and motion analysis technologies.

° Bi Fintech PTE. Ltd. acquires Korea Framing Institute Co. Ltd for an undisclosed amount

On April 19, 2018, Bi Fintech PTE. Ltd. acquired Korea Framing Institute Co, a developer of authentication software.

° Zhong Fu Tong Group Co. acquires Time Channel Information Technology Co. for $36 million

On May 11, 2018, Zhong Fu Tong Group acquired Time Channel Information Technology Co., a developer of a biometric identification platform.

December 2018 53

Identity Solutions Sector Security Industry Monitor

° Thales S.A. acquires Gemalto N.V. for $6.7 billion

On December 17, 2017, Thales S.A. acquired Gemalto N.V., a provider of digital security products and services worldwide.

° HID Global Corporation acquires Cross Match Technologies, Inc. for an undisclosed amount

On September 24, 2018, HID Global Corporation acquired Cross Match Technologies, a manufacturer of biometric identity management solutions.

Registered Direct and Private Placement Snapshot

The first three quarters of 2018 saw significantly more private placements in the Identity Solutions Sector than the same period the year prior.

° Visualant, Inc. raised $3.35 in equity and debt

On March 16, 2018, Visualant, Inc., a provider of an identification, authentication, and diagnosis solution raised $3.35 million from two undisclosed investors.

° Elephant Smart Business raised $.74 million

On February 23, 2018, Elephant Smart Business, a developer of biometric and touch-screen terminals announced a round of founding from Longford County Enterprise Board, Enterprise Ireland, and other private investors.

° D-ID announced $4 million in Seed round funding

On January 22, 2018, D-ID, a developer of face recognition defense technology announced a Seed round of funding led by new investor Pitango Venture Capital.

Public and Rule 144A Debt and Equity Offering Snapshot There was more activity in the Identity Solutions public offerings sector in the first three quarters of 2018 than the first three quarters of 2017.

° Topfield Co., Ltd. received $.93 million in equity

On February 23, 2018, Topfield Co., Ltd. received $.93 million in a follow-on equity offering. The company engages in medical, bio, kiosk, and biometric physical security.

Bankruptcies There were no significant Identity Solutions bankruptcies in the first three quarters of 2018.

54 December 2018

Security Industry Monitor Identity Solutions Sector

Notable Transactions

Figure 17: Select M&A Transactions in the Identity Solutions Sector, 3Q16 Through 3Q18 Announced Target Closed TEV / TEV / / Filing Target Business Description Buyer Implied TEV Date Revenue EBITDA Date ($mm) Oberthur Technologies Safran Identity and Security SAS develops security and Safran Identity and SA (nka:IDEMIA France 09/29/2016 5/31/2017 identity solutions for people, government, and business $2,726.4 1.5x 12.6x Security SAS SAS); Bpifrance applications. Investissement

Point Grey Research Inc. designs and manufactures digital Point Grey Research FLIR Integrated Imaging 10/01/2016 11/4/2016 cameras for industrial, medical and life science, traffic, $252.5 NA NA Inc. Solutions, Inc. biometric, GIS, and people counting applications.

NexID Biometrics LLC provides spoof mitigation and liveness 12/13/2016 2/10/2017 NexID Biometrics LLC Precise Biometrics AB $3.5 NA NA detection solutions for the biometric authentication industry.

ID Watchdog, Inc., through its subsidiary, Identity Rehab Corporation, provides identity theft detection, protection, and Equifax Consumer 01/06/2017 8/10/2017 ID Watchdog, Inc. $63.0 5.6x 79.2x resolution services primarily to individuals and families on a Services, Inc. subscription basis in the United States.

Delta ID Inc. designs and develops a biometric identity and Fingerprint Cards AB 02/01/2017 6/7/2017 Delta ID Inc. $120.0 NA NA authentication solution based on iris recognition technology. (publ)

Acculynk, Inc. provides payment processing and authentication softw are solutions for online and mobile 03/16/2017 5/1/2017 Acculynk, Inc. First Data Corporation $85.0 NA NA commerce markets in the United States, China, India, Puerto Rico, and internationally.

Infracast Ltd develops and provides mobile communication, 03/27/2017 3/27/2017 Infracast Ltd IMImobile PLC $21.0 1.6x 41.7x identity, and security solutions.

SecurEnvoy Ltd. provides based tokenless tw o- 04/20/2017 5/9/2017 SecurEnvoy Ltd. Shearw ater Group PLC $25.7 6.2x 9.2x factor authentication solutions.

TeleSign Corporation operates a cloud communications Belgacom International 04/25/2017 10/31/2017 TeleSign Corporation $230.0 2.3x NA platform. Carrier Services SA

December 2018 55

Identity Solutions Sector Security Industry Monitor

Announced Target Closed TEV / TEV / / Filing Target Business Description Buyer Implied TEV Date Revenue EBITDA Date ($mm) ID Watchdog, Inc., through its subsidiary, Identity Rehab Corporation, provides identity theft detection, protection, and Equifax Consumer 06/16/2017 8/10/2017 ID Watchdog, Inc. $63.0 5.6x 79.2x resolution services primarily to individuals and families on a Services, Inc. subscription basis in the United States.

Dhimyotis, Société Anonyme develops and delivers solutions Dhimyotis, Société 07/27/2017 7/27/2017 for authentication, encryption, electronic signature, time Tessi SA NA NA NA Anonyme stamping, and storage of probative.

As of August 9, 2017, CrossResolve, LLC w as acquired by KeyLogic Systems, Inc. CrossResolve, LLC offers government 08/09/2017 8/9/2017 CrossResolve, LLC KeyLogic Systems, Inc. NA NA NA advisory and strategy services w ith a focus on biometrics, forensics, and identity programs.

Euronovate S.A. provides biometric signature solutions in 10/31/2017 10/31/2017 Euronovate S.A. Topaz Systems, Inc. $14.0 NA NA Sw itzerland.

Acumen Security, Acumen Security, LLC offers product and services 12/13/2017 12/13/2017 Intertek Group plc NA NA NA LLC certification services.

KeyLemon S.A. provides biometric identification and motion analysis technologies that deliver drop-in facial recognition, 02/06/2018 2/28/2018 KeyLemon S.A. ams AG NA NA NA speaker identification, and motion tracking to developers and manufacturers across various industries and institutions.

Korea Framing Korea Framing Institute Co., Ltd. develops authentication 04/19/2018 4/19/2018 Bi Fintech PTE. Ltd. NA NA NA Institute Co., Ltd. security softw are.

Time Channel Time Channel Information Technology Co.,Ltd. develops Zhong Fu Tong Group 06/10/2018 6/10/2018 Information $47.2 4.4x 14.8x platforms for biometric identification. Co., Ltd. Technology Co.,Ltd.

SMS Passcode A/S provides adaptive multi-factor Entrust Datacard 06/30/2018 6/30/2018 SMS Passcode A/S authentication platform to governments, telcos, enterprises, NA NA NA Corporation and financial institutions w orldw ide.

HealthCast Inc. provides access and identity management Identity Automation 07/24/2018 7/24/2018 HealthCast Inc. NA NA NA solutions to health care providers. Systems, LLC

Sources: Capital IQ and Imperial Capital, LLC.

56 December 2018

Security Industry Monitor Information Security Sector

Section IV

Information Security Sector

December 2018 57

Information Security Sector Security Industry Monitor

[This page intentionally left blank.]

58 December 2018

Security Industry Monitor Information Security Sector

Information Security Sector Sector Outlook and Commentary

Threats continue to evolve rapidly with broadening impact beyond data breaches to life safety and homeland security. Even larger organizations, with well-established Security Operations Centers (SOCs), are often overwhelmed by massive volumes of alerts from an array of deployed security tools and sensors, impeding their ability to validate, prioritize, and respond to the most critical threats. The security industry is now responding to customer demand for higher fidelity alerts, leveraging new technologies such as artificial intelligence (AI), machine learning (ML), and data analytics. In addition, security spending is shifting decisively from “point solutions” incapable of communicating with other tools to “integrated solutions” that collectively strengthen an organization’s overall security posture through enhanced coordination and visibility.

However, mid-market and smaller organizations face the same security risks as larger organizations, but have comparatively far more limited resources and few (if any) skilled security analysts within their information technology (IT) departments. This shortfall has created new opportunities for Managed Security Services Providers (MSSPs) and specifically Managed Detection and Response (MDR) services to provide active threat hunting and defense and enable rapid containment and mitigation of threats. According to market researcher Gartner, emerging services in the MSS market totaled about $940 million in 2016, encompassing MDR, Infrastructure-as-a-Service (IaaS) monitoring, Software-as-a-Service (SaaS) monitoring through Cloud Access Security Brokers (CASB), network traffic analysis, and threat intelligence platforms.

Driven by the migration of IT workloads to cloud infrastructures and mobile workforces, legacy security tools are insufficient and out of position to defend against modern threats because network perimeters has become increasingly less defined and extend well beyond the corporate data center. One of the most critical challenges facing the industry has been the rapid proliferation of Internet of Things (IoT) devices, which presents inherent security challenges due to their simplicity and the low prioritization or security across the industry. Attacks against IoT devices could have real world implications on life safety and national security, driving greater cyber-physical security convergence and first-ever legislation passed in the United States mandating the implementation of new security features.

Internet of Things (IoT) Security

Pervasive and persistently connected, IoT devices have enabled tremendous convenience and operational efficiency while vastly expanding the attack surface and cybersecurity risks for people and organizations. Market research firm Gartner estimates approximately 8.4 billion IoT devices were in use worldwide in 2017 and expects the installed base will exceed 20 billion devices by 2020. Given perceived cost constraints, as well as lack of regulation and customer demand, IoT devices typically lack even basic security protections and often ship with default login credentials (passwords are sometimes even hard coded), making them exceptionally susceptible to attackers. Given the escalating risks, the IoT security market is rapidly emerging and security spending is beginning to ramp. According to researcher IoT Analytics Research, spending for IoT security is expected to reach $4.4 billion in 2022, up from $703 million in 2017, achieving a CAGR of 44%.

December 2018 59

Information Security Sector Security Industry Monitor

Figure 18: IoT Security Spending, 2017-2022 (in $ millions)

$5,000

$4,500 4,389

$4,000

$3,500

3,024 $3,000

$2,500 2,083 $2,000

1,439 $1,500

1,001 $1,000 703

$500

$0 2017 2018 2019 2020 2021 2022

Sources: IoT Analytics Research.

Of particular concern, even if devices can be changed, is that many users still do not apply unique or strong login credentials. According to a study by vendor ESET, 15% of 12,000 home routers tested had poor passwords. Even when vulnerabilities are discovered, manufacturers have little or no ability to update or patch deployed devices. Following the installation of an IoT device, personal information and data can spread almost immediately around the world with no user interaction or even awareness. According to a test performed by security vendor Dark Cubed, 12 off-the-shelf IoT devices made over 1.25 million communications to 3,000+ external servers within a year. We note that IoT security encompasses four different levels: Device, Communications, Cloud, and Lifecycle Management.

60 December 2018

Security Industry Monitor Information Security Sector

Figure 19: Levels of IoT Security

Sources: IoT Analytics.

Most IoT devices are directly connected to the Internet, making them difficult to defend against threats. There are generally no security tools or services that sit between these devices and potential attackers. In addition, IoT devices do not typically have built-in anti-malware capabilities. Attackers do not even need to develop zero-day exploits because many devices have known vulnerabilities which are not easily patched by users. As a result, it has proven difficult to break the attack chain, from malware interdiction to eliminating known vulnerabilities to blocking threats.

Earlier this year, approximately 500,000 routers across more than 50 countries were compromised by a sophisticated malware system called VPNFilter. This malware could not only steal website credentials and monitor SCADA protocols, but also had destructive capabilities to make unusable specific devices or broad swaths of devices. Additionally, attackers have subverted IoT devices to form massive “botnets” to overwhelm the network resources of targeted organizations and disrupt legitimate usage through Distributed Denial-of-Service (“DDoS”) attacks.

December 2018 61

Information Security Sector Security Industry Monitor

Figure 20: VPNFilter Malware Is a Multi-Stage, Modular Platform

Sources: Talos.

One area of particular concern is the extensive reach of China-related device manufacturers and associated infrastructure, encompassing even innocuous products such as IoT light bulbs, which readily communicate with servers in China. For example, dimming an IoT lightbulb may require connecting to China and enabling real-time location sharing through an insecure Android application. Systemic security flaws represent a major risk to the usage of IoT devices, with potential national security implications. Ideally, a trusted provider would handle all of the key functions associated with an IoT device, including firmware, platform, and mobile application.

Unlike profit-motivated cybercriminals, nation-states are primarily focused on gaining strategic advantage. Security researchers and leaders have widely noted the risks of compromised supply chains and critical infrastructure by potential adversaries. Secure and trusted communications will become increasingly critical to mitigate the threats to IoT devices. Cost is not a major impediment for manufacturers because secure devices, applications, and infrastructures are marginally more expensive than insecure IoT devices. However, given limited attention by manufacturers to the security of IoT devices, it is not readily apparent for purchasers to differentiate between secure and insecure products and applications.

62 December 2018

Security Industry Monitor Information Security Sector

Figure 21: IoT Device Overview

Sources: Dark Cubed.

Insecure IoT devices typically operate on platforms without encrypted communications (or attackers can easily bypass poorly implemented encryption). Given the prevalence of known vulnerabilities, it appears likely that manufacturers rarely (if ever) perform security reviews of their IoT devices to prevent attackers from observing unencrypted communications between these devices and the cloud. In addition, many IoT devices can be controlled by smart phones through Android-based mobile applications. Some of these applications require key permissions, which could allow the compromise of passwords, malware injection, or data theft from other mobile applications. From a privacy perspective, personal data can be mined for advertising purposes or worse. Applications also frequently communicate to web servers located globally.

Cyber-Physical Security Convergence

Expanding integration of IoT, sensors, devices, and automated systems has real world implications on life safety and operational stability, blurring the distinction between historically separate silos of physical and logical security. Both functions must now collaborate and exchange information, which will increasingly shift the security industry from a reactive to pro-active/prevention model. Industry stakeholders are rapidly adapting to the modern threat environment, with the goal of elevating the capabilities of physical security systems with more hardened solutions and built-in protections for connected devices. Recently, Underwriters Laboratories (UL), an independent global safety consulting and certification organization, initiated its Cybersecurity Assurance Program (UL CAP), which creates standards and testable criteria in order to assess vulnerabilities and minimize risks of connect devices. UL CAP could broadly reduce the risk of exploitation and prevent impact from known malware, while enhancing security controls and expanding security awareness. UL CAP could benefit from broad-based adoption because it leverages the set of standards from UL 2900 developed in coordination with major stakeholders across government,

December 2018 63

Information Security Sector Security Industry Monitor

industry, and academia. Given the broadening threat environment, security integrators are increasingly offering “Cybersecurity-as-a-Service” and are working to evolve their businesses from traditional hardware or monitoring services to full-spectrum solution providers, generating actionable intelligence and enabling real-time situational awareness for organizations across a broad range of vertical markets.

Emerging Legislation on IoT Security

Given the systemic problems of securing IoT devices and minimal industry incentives, government regulation could become increasingly prevalent over the coming years. In October 2018, the state of California passed one of the first ever IoT cybersecurity laws in the United States, which was signed by Governor Jerry Brown. This law, known as Senate Bill No. 327 Information privacy: connected devices,(SB 327) prohibits the sale of Internet-connected devices with weak default passwords and mandates that manufacturers implement “reasonable security features” into their IoT devices in order to prevent unauthorized access or data breaches. In practical terms, new IoT devices will be shipped with a unique password and/or users will have to create a new password. While SB 327 does not specify exactly how vendors should secure their devices, it does state that new products must contain “a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time.”

This law will be effective starting January 1, 2020, which could have far-reaching global impact, given the vast deployments of IoT devices, notable vendors, and scale of the California market. One area this law does not cover is a mandate for continuous security enhancements, including security patches for known vulnerabilities. Future legislation may broaden the scope of SB 327 and other U.S. states could use SB 327 as a framework for similar legislation. There are a number of federal IoT security bills currently in the works, but they have not been voted on by Congress. For example, the IoT Cybersecurity Improvement Act of 2017 sets minimum security standards for IoT devices that are purchased by the federal government. Another bill, the IoT Consumer TIPS Act of 2017, would help educate consumers about IoT devices through the Federal Trade Commission (FTC). Lastly, the SMART IoT Act would study the state of the industry through the Department of Commerce.

While SB 327 is widely considered a step in the right direction, critics have questioned why the legislation didn’t mandate the removal of insecure features such as listening ports and Web management cross-site scripting and SQL injection issues. Additionally, SB 327 does not include rules around other, non- password authentication systems.

Rise of the Machine: Machine Learning and Artificial Intelligence in Cybersecurity

In the security operations center (SOC), human analysts simply cannot scale to what is fundamentally a machine problem. Organizations have deployed countless point solutions and security tools, each generating alerts on possible intrusions and compromises, but generally without context or actionable insights. Escalating volumes of false positives and non-critical alerts are overwhelming SOC analysts, who can only investigate and validate a finite number of security incidents per day. As a result, organizations are increasingly adopting data analytics platforms based on machine learning (ML) and artificial intelligence (AI) technologies to correlate large data sets, help validate alerts, and enable faster response.

64 December 2018

Security Industry Monitor Information Security Sector

Of particular note, these platforms are not likely to supplant human SOC analysts for the foreseeable future, but will augment their capacity by offloading mundane and repetitive tasks. Analytics represent a significant “force multiplier” and enable skilled human analysts to focus on the most critical and sophisticated threats that require high levels of experience and knowledge.

One of the key drivers is the massive and widening shortage of cybersecurity talent, which has been widely reported by industry trade journals. This trend is raising the urgency for solutions that improve the security posture of organizations without simply adding to the noise. While ML is not a “new” technology, what has changed is the accelerating speed of iterative and complex mathematical calculations to big data automatically (thereby learning from previous calculations) and independently adapting based on new data. According to analytics vendor SAS, machine learning is “a method of data analysis that automates analytical model building. It is a branch of artificial intelligence based on the idea that systems can learn from data, identify patterns and make decisions with minimal human intervention.” For reference, SAS cited several high profile examples of ML applications, such as Google’s self-driving car and selection recommendations by Amazon and Netflix.

ML is a major sub-field of AI, which enables machines to perform human-like tasks by finding and learning from patterns in the data and adjusting to inputs. AI has been buoyed by recent breakthroughs in deep learning, as well as advanced algorithms and ramping computer processing power and storage. AI systems must learn from large volumes of data, granular data, and diverse data in order to be trained for a specific and highly specialized task. Of particular note, self-learning systems are not autonomous systems and complement human abilities. Enterprise security software that leverages AI can automate threat detection and response, helping to efficiently identify threats. Some systems utilize multiple algorithms trained on different data sets to more effectively detect anomalies and minimize false positives. One notable ML application in cybersecurity has been User and Entity Behavior Analysis (UEBA), which looks for unusual behavior or patterns compared with baseline activity. As such, the detection and blocking of potentially malicious activity does not rely upon known signatures.

False positives remain the critical weakness of legacy security tools and consume substantial analyst resources, while also obscuring real and potentially critical threats. According to cybersecurity certification and training organization SANS Institute, this wasted activity costs organizations about $1.3 million annually because analysts are responding to “inaccurate and erroneous intelligence” or “chasing erroneous alerts.” However, AI/ML-based cybersecurity solutions are not effective (both false positives and false negatives) without training the system on sufficient volumes of the right data. Human analysts will remain crucial to investigate and validate alerts, while benefiting from a platform that can process massive volumes of network activity data without extensive teams and legacy tools.

It is important to note that AI/ML technologies are equally available to attackers and defenders. Attacks could match the ability of humans, but at much higher velocity, ultimately resulting in more affected organizations and individuals. AI/ML enables far greater automation and scale at lower cost, with learning capabilities finding vulnerabilities and more precise targeting. These advantages will need to be countered by defenders with the same capabilities and perpetuating the arms race in cybersecurity.

December 2018 65

Information Security Sector Security Industry Monitor

M&A Review and Outlook

° M&A activity in the Information Security Sector continued to show strength through the end of 2017 and beginning of 2018 and then slowed following the end of 1Q18

Figure 22: M&A Transactions in the Information Security Sector, 3Q13 to 3Q18

70

60

50

40 35

30 21 20 15 13 13 11 11 9 9 9 10 8 8 7 8 6 5 6 6 4 3 4 - Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 2013 2013 2014 2014 2014 2014 2015 2015 2015 2015 2016 2016 2016 2016 2017 2017 2017 2017 2018 2018 2018

IT Security Services IT Security Products

Sources: Imperial Capital, LLC and Capital IQ.

Notable Middle Market Transactions

° Palo Alto Networks, Inc. acquired Evident.io, Inc. for $300 million

On March 14, 2018, Palo Alto Networks, Inc. acquired Evident.io, Inc., a provider of a software platform for enterprise security management.

° Bomgar Corporation acquires Avecto Limited for an undisclosed amount

On July 10, 2018, Bomgar Corporation acquired Avecto Limited, a provider of endpoint security software solutions that protect businesses from advanced threats.

° Okta, Inc. acquires AuthClub, Inc. for an undisclosed amount

On July 18, 2018, Okta, Inc. acquired AuthClub, Inc., a provider of a tool to manage authentication across applications and clouds.

° Imperva, Inc. acquires Prevoty, Inc. for $140.6 million

On July 26, 2018, Imperva, Inc. acquired Prevoty, Inc., a provider of web application security.

° Cisco Systems, Inc. acquires Duo Security, Inc. for $2.35 billion

On August 2, 2018, Cisco Systems, Inc. acquired Duo Security, Inc., a provider of cloud-based access protection solutions.

66 December 2018

Security Industry Monitor Information Security Sector

Registered Direct and Private Placement Snapshot

Private placement was significantly greater in first three quarters of 2018 than 2017.

° Threat X, Inc. received $8.2 million in a Series A round

On April 4, 2018, Threat X, Inc., which operates as an intelligent security management company, raised $8.2 million in a Series A round led by new investors Grotech Ventures and Access Venture Partners.

° StackRox, Inc. received $25 million in a Series B round

On April 10, 2018, StackRox Inc., a provider of an online threat protection platform raised $25 million in a Series B round led by Redpoint Ventures.

° Exabeam, Inc. received $50 million in a Series D round

On August 14, 2018, Exabeam Inc., a provider of a behavior-based security intelligence platform, received $50 million in a Series D round led by existing investor Lightspeed Venture Partners.

Public and Rule 144A Debt and Equity Offering Snapshot

Public offerings in the Information Security Sector maintained started off strong in the first quarter of 2018. The Information Security Sector has seen more activity in the first three months of 2018 than 2017.

° Zscaler, Inc. raised $192 million in an IPO

On February 16, 2018, Zscaler received $192 million in an IPO. The company operates as a cloud security company.

° Rapid7, Inc. raised $114 million in a follow-on equity offering

On January 23, 2018, Rapid7, Inc. raised $114 million in a follow-on equity offering. The company provides analytics solutions for security and information operations.

Bankruptcies

There was one notable Information Security Solutions bankruptcy in first three quarters of 2018.

° Giant Gray, Inc. filed for bankruptcy in 2Q18

On April 13, 2018, an involuntary petition for liquidation under Chapter 7 was filed against Giant Gray, Inc. in the U.S. Bankruptcy Court for the Southern District of Texas. Giant Gray, Inc. develops a multi-sensor data-fusion/cognitive neurolinguistics software platform that teaches itself to recognize and alert users on abnormal behavior patterns.

December 2018 67

Information Security Sector Security Industry Monitor

Notable Transactions

Figure 23: Select M&A Transactions in the Information Security Sector, 3Q16 Through 3Q18 Target Announced / TEV / TEV / Closed Date Target Business Description Buyer Implied TEV Filing Date Revenue EBITDA ($mm)

Elitecore Technologies Pvt. Ltd. provides OSS/BSS and Internet security Intel Security Inc. (nka:McAfee 09/07/2016 4/3/2017 solutions to configure, manage, and monitor netw ork and subscriber TPG Capital, L.P. $4,156.9 NA NA LLC) activities.

Camber Corporation provides engineering and technical services, cyber operations technology, mission critical support services, and training Huntington Ingalls 11/01/2016 12/1/2016 Camber Corporation $345.0 0.9x 8.6x solutions to the United States federal agencies and affiliates, and Industries, Inc. international government and commercial customers. As of February 27, 2017, EarthLink Holdings Corp. w as acquired by Windstream Holdings, Inc. EarthLink Holdings Corp. provides managed 11/05/2016 2/27/2017 EarthLink Holdings Corp. Windstream Holdings, Inc. $1,060.7 1.1x 5.1x netw ork, security, and cloud services to business and residential customers in the United States.

LifeLock, Inc. provides identity theft protection services for consumers; 11/20/2016 2/9/2017 LifeLock, Inc. and consumer risk management services for enterprises in the United Symantec Corporation $2,362.1 3.6x 50.0x States.

MacDonald Humfrey L-3 Communications L-3 MacDonald Humfrey provides engineering, procurement, and 11/22/2016 11/22/2016 (Automation) Ltd. (nka:L-3 Holdings, Inc. (nka:L3 $315.8 NA NA construction services in the United Kingdom. MacDonald Humfrey) Technologies, Inc.)

View finity, Inc. provides generation application control and privilege Synchronoss 12/05/2016 1/19/2017 IntraLinks Holdings, Inc. management solutions for securing desktop, laptop, and server $855.5 2.9x 42.8x Technologies, Inc. environments in enterprises.

02/08/2017 3/22/2017 Invincea, Inc. Invincea, Inc. develops endpoint security softw are solutions. Sophos Group plc $120.0 12.2x NA

03/06/2017 4/3/2017 Veracode, Inc. Veracode, Inc. provides a cloud-based application security platform. CA, Inc. $614.0 NA NA

Sotera Defense Solutions, Inc., a security technology company, provides 03/08/2017 4/4/2017 Sotera Defense Solutions, Inc. technology-based systems, solutions, and services for national security The KEYW Corporation $350.3 1.3x 15.6x agencies and programs of the U.S. government.

Viptela, Inc. provides softw are-defined w ide area netw ork (SD-WAN) 04/27/2017 7/31/2017 Viptela, Inc. technology that allow s global companies to build carrier agnostic, policy- Cisco Systems, Inc. $610.0 NA NA controlled, and cost-effective WANs.

Thinklogical LLC designs and manufactures signal extension and 05/04/2017 5/31/2017 Thinklogical LLC sw itching systems to access, transport, distribute, display, and analyze Belden Inc. $160.0 3.1x 9.3x video-rich big data.

As of September 21, 2017, Sandvine Corporation w as acquired by Vector Capital; Vector 05/26/2017 5/26/2017 Sandvine Corporation Procera Netw orks, Inc. Sandvine Corporation provides netw ork $408.8 3.6x 24.0x Capital V, L.P. intelligence products for netw ork operators w orldw ide.

Westcon Group, Inc., a technology distributor, provides security, 06/05/2017 9/1/2017 Westcon Group, Inc. collaboration, netw orking, and data center products to customers in the SYNNEX Corporation $830.0 0.2x 15.8x United States and internationally.

Peak 10 Holding ViaWest, Inc. (nka:Flexential Flexential Colorado Corp. provides information technology (IT) and 06/12/2017 8/1/2017 Corporation (nka:Flexential $1,675.0 NA NA Colorado Corp.) infrastructure solutions for businesses in North America. Intermediate Corporation)

68 December 2018

Security Industry Monitor Information Security Sector

Target Announced / TEV / TEV / Closed Date Target Business Description Buyer Implied TEV Filing Date Revenue EBITDA ($mm)

Komand, Inc. develops a security orchestration and automation system 07/12/2017 7/12/2017 Komand, Inc. Rapid7, Inc. $14.8 NA NA platform.

Guidance Softw are, Inc., a technology company, provides forensic 07/25/2017 9/13/2017 Guidance Softw are, Inc. Open Text Corporation $245.2 2.3x NM security solutions in the United States, Europe, Asia, and internationally.

Skyhigh Netw orks, Inc., a cloud access security company, enables Acorn Grow th Companies; companies to embrace cloud services w ith appropriate levels of security, 09/25/2017 9/25/2017 CIS Secure Computing, Inc. Acorn Grow th Capital NA NA NA compliance, professional services, healthcare, high technology, media and Fund IV, L.P. entertainment, manufacturing, and legal customers. Skyhigh Netw orks, Inc., a cloud access security company, enables companies to embrace cloud services w ith appropriate levels of security, 11/27/2017 1/3/2018 Skyhigh Netw orks, Inc. McAfee LLC NA NA NA compliance, professional services, healthcare, high technology, media and entertainment, manufacturing, and legal customers.

12/17/2017 12/17/2017 Gemalto N.V. Gemalto N.V. provides digital security products and services w orldw ide. Thales S.A. $6,341.1 1.8x 13.1x

12/19/2017 12/19/2017 Cloud Harmonics Inc. Cloud Harmonics Inc. offers cloud-based security solutions. Ingram Micro Inc. NA NA NA

Phantom Cyber Corporation provides security automation and 02/27/2018 4/9/2018 Phantom Cyber Corporation orchestration platform that orchestrates key stages of security operations Splunk Inc. $350.0 NA NA from prevention to triage and resolution.

First Base Technologies LLP provides cyber security testing and 03/06/2018 3/12/2018 First Base Technologies LLP Falanx Group Limited $4.5 1.8x 5.3x consulting services.

FourV Systems, LLC develops a cyber security softw are for operations, 03/29/2018 3/29/2018 FourV Systems, LLC OPAQ Netw orks, Inc. NA NA NA analytics, and reporting.

Cognosec AB (publ) 04/09/2018 6/26/2018 Advantio Limited Advantio Limited provides cyber security services. $10.6 3.0x 17.1x (nka:Cyber Security 1 AB)

Sysdream provides IT security services on systems audit, computer 06/22/2018 6/22/2018 Sysdream Hub One Mobility S.A.S. NA NA NA security training, and cyber-training.

MWR InfoSecurity Limited provides cyber security consultancy services to 06/18/2018 7/2/2018 MWR InfoSecurity Limited F-Secure Oyj $139.2 4.9x NA clients w orldw ide.

Avecto Limited develops endpoint security softw are solutions that protect 07/10/2018 8/1/2018 Avecto Limited Bomgar Corporation NA NA NA businesses from advanced threats.

Securestorm Ltd. provides cyber and cloud security consultancy 07/17/2018 7/17/2018 Securestorm Ltd. Falanx Group Limited $0.1 NA NA services.

Iron Man Protection, LLC provides security solutions and risk management Optium Cyber Systems, 08/22/2018 10/1/2018 Iron Man Protection, LLC NA NA NA services to individuals, corporations, and governments w orldw ide. Inc.

Sources: Capital IQ and Imperial Capital, LLC.

December 2018 69

Information Security Sector Security Industry Monitor

[This page intentionally left blank.]

70 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Section V

Unmanned Aerial Systems Sector

December 2018 71

Unmanned Aerial Systems Sector Security Industry Monitor

[This page intentionally left blank.]

72 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Unmanned Aerial Systems Sector Sector Outlook and Commentary

Historically exclusive to the defense and homeland security industries, advancements in technology – particularly propulsion systems, control systems, software, and cameras – has led to significant growth in commercially available Unmanned Aerial Systems (UAS) as well as the understanding of their value proposition for many different non-military applications. Whereas the term “UAV” indicates the actual aircraft (aka “Drone”), the term “UAS” refers to an Unmanned Aerial System where the system may include the UAV itself as well as a ground-based controller, communications, etc.

We believe implications for the security industry are far reaching with potential applications for public safety and security, private security and guarding as well as home security. UAS’ can provide a cost effective additional layers of protection, enhancing providers’ security offering and potentially reducing operating costs.

We believe drones are beginning to reach market acceptance with companies across industries realizing the benefits – both in terms of cost savings and direct ROI – of using drones. More large corporations are starting pilot programs, hiring drone services companies or setting up in-house drone programs. Large traditional aerospace and defense companies are participating in the sUAS market through corporate venture investments, having become more active in 2018.

For security, we see large integrators beginning pilot programs for perimeter security of industrial, oil & gas, warehouse, and other facilities.

With adoption increasing across industries, hurdles remain before companies can fully reap the benefits of drones, particularly autonomous operations, flying in urban environments and over people. The recent passing of the FAA Reauthorization Act of 2018 laid the groundwork for further development of the drone ecosystem and integration into the National Air Space (NAS).

U.S. Regulation and Airspace Safety

With the passing of the FAA Reauthorization Act of 2018 (H.R. 302), a significant step forward was taken towards UAS integration into the NAS. Most importantly, in our view, H.R. 302 includes provisions outlining the implementation of an UAS Traffic Management system (UTM), Beyond Visual Line-of-Sight (BVLOS) as well as remote ID – all significant pieces of the UAS integration pyramid. Pieces of the legislation that are important for security providers exploring and /or implementing drone programs include:

December 2018 73

Unmanned Aerial Systems Sector Security Industry Monitor

° Repeal of Section 336 from the FAA Reauthorization Act of 2012, a carve out for recreation sUAS operators.

Why It’s Important: Includes specific language related to remote ID for recreational sUAS, paving the way for a fully integrated Remote ID system which is required for drone integration into the NAS.

° Authorizing the establishment of the Unmanned Aircraft Systems Integration Pilot Program (UAS IPP) as stated in a Presidential Memo from October 2017.

Why It’s Important: The UAS IPP section H.R. 302 specifically includes provisions for:

° Testing and validating new BVLOS, focusing on detect and avoid technologies, command and control links, navigation, weather, and human factors

° Addressing concerns regarding potential security and safety risks with UAS operating near people and critical infrastructure

° Part 107 transparency and revision of waiver and certificate authorization process.

Why It’s Important: Under the provision, the FAA is required to publish on its website a sample of safety justifications1 provided by sUAS operators that have been approved for each regulation waived or class of airspace authorized. This will remove the current opaqueness surrounding the circumstances for which waivers or certifications were granted easing the waiver application process.

° Mandating the FAA establish a pilot program through September 30, 2023 to utilize available remote detection or identification technologies for safety oversight as well as enforcement actions against operators breaking aviation laws and regulation.

Why It’s Important: For UAS autonomy in the NAS, law enforcement authorities need the capability for real-time tracking of drone operations as well as knowledge of the owner and/or operator, particularly for the investigation of incidents and enforcement actions when necessary.

° Directs the FAA to develop a plan for implementation of UTM services that expand BVLOS operations. Establishes a primary objective of UTM to “permit blanket waiver authority” to allow UAS operation approved by a selected (by the FAA) UTM services provider instead of the current case-by-case waivers under Part 107.

Why It’s Important: With the support of Congress, the FAA now has clear support and direction to develop UTM which is required for a fully integrated NAS. The mandated objective of using UTM services for approved flight instead of the case-by-case waiver will significantly reduce the time to drone deployment as well as provide more UAS operators the ability to fly.

1 When applying for a waiver, UAS operators are required to provide an explanation of hazards and risks associated with the proposed flight, justifying that the operation is safe

74 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

UAS Integration into the U.S. National Airspace

With the passing of H.R. 302, the U.S. government has communicated its commitment to UAS integration as well as a potential plan on how to implement it through the FAA, partner agencies (such as NASA) and industry stakeholders. More importantly, security practitioners across commercial, HLS, first responders and search and rescue (S&R) are now provided with a structured approach to UAS integration, eventually leading to UAS operations in urban environments, BVLOS, at night and above people.

With the commitment to infrastructure, now comes the implementation stage. Most importantly, for full UAS integration, the industry will need several components to come together to create a complete UTM system including: Aircraft deconfliction – at scale, remote ID, reliable and secure communications, advanced collision detection and avoidance, and automatic safe landing mechanisms.

Figure 24: The Path to Full UAS Integration

Sources: FAA.

For security providers and public safety agencies, H.R. 302 enables the formal groundwork to be laid for autonomous drone patrols and automatic event response – either around the perimeter or even throughout a city. Currently, a drone cannot be flown without an operator or Remote Pilot in Command (RPIC) having visual line of sight (VLOS) of the drone or at night or above people without a special waiver from the FAA, limiting capabilities and where a drone can be used. Urban environments remain relatively off-limits based on the current NAS drone infrastructure.

December 2018 75

Unmanned Aerial Systems Sector Security Industry Monitor

With a fully integrated UTM system and BVLOS operations permitted, an industrial park near a busy airport could deploy drone-in-a-box solutions, pre-set drone patrol time, instantaneously get a flight plan approved through a LAANC services provider and communicate those plans to other operators and/or directly to other drones in the area. For urban environments, this could mean a fleet of drone stations deployed throughout a city patrolling autonomously or launching automatically in response to an event that could be miles away without the need for human supervision.

Figure 25: UTM Structure

Sources: Airmap, Imperial Capital, LLC.

Aircraft Deconfliction – The UAS Service Suppliers

As part of the first step towards UTM, the FAA began the roll-out of its Low Altitude Authorization and Notification Capability (LAANC) program earlier this year. LAANC provides real-time processing of airspace authorization requests for UAS operations in controlled airspace instead of the drone operator needing to request a special waiver from the FAA, which could take up to 90 days. Flight approval can be obtained by using one of the numerous UAS Service Suppliers (USS) authorized by the FAA. In our April 2018 Security Monitor there were four approved providers – Airmap, Project Wing, and Skyward (a Verizon company). Since then, the FAA has expanded the list of authorized USSs under LAANC to 11 providers and has rolled out the program nationwide, opening 99% of U.S. airspace to commercial drone activity.

Before granting authorization for a drone flight, a USS’s solution will collect and process numerous data points from sources including the FAA’s Air Traffic Management (ATM) and Flight Information Management Systems (FIMS), as well as weather and terrain information. That information is then synthesized with flight information provided by the drone operator regarding altitude, waypoints, flight time, type of drone, etc. Additionally, while planning a flight, a drone operator will receive information regarding any advisories including flight restrictions, if any.

76 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Figure 26: M&A Approved LAANC UAS Service Suppliers

Sources: FAA.

Figure 27: UAS Service Suppliers Operations and Data Flow

Sources: FAA.

December 2018 77

Unmanned Aerial Systems Sector Security Industry Monitor

Select UAS Service Suppliers

° Aerodyne: Based in Cape Canaveral, FL, Aerodyne is a provider of drone-based enterprise solutions using AI for large scale data capture and analytics. Aerodyne’s solution provides sUAS’s with real-time data analysis enabling autonomous flight through UTM, as well as airspace and flight path management.

° Airmap: Santa Monica, CA-based Airmap is a leading airspace services platform for UAS. Airmap’s solutions enable flight planning, operation authorization request and approval, drone identification, and traffic management leading to a quick, safe and lawful drone operation in controlled airspace.

° Altitude Angel: Headquartered in Reading, Berkshire, U.K., Altitude Angel provides airspace management data and services. Its cloud-based platform enables the transmission of real-time identification, airspace, environmental, and regulatory information to drone operators and airspace authorities.

° Kittyhawk.io: Based in San Francisco, CA, Kittyhawk provides real-time flight management and operations solutions. Kittyhawk’s solution offers pre-flight planning, in-flight operations, UTM and real-time application, and approval for airspace authorizations.

° Unifly: Based in Antwerp, Belgium, Unifly provides UTM systems, facilitating drone operations in the very-low-altitude airspace. Unifly has participated in many projects working towards UTM integration including U-space, CLASS, CORUS, and SKYOPENER.

Remote Identification and Tracking

Prior to the passing of H.R. 302, the potential for a widespread remote ID system was limited to commercial operations due to a special exemption granted for recreational fliers under Section 336 of the FAA Modernization and Reform Act of 2012. With the removal of this special exemption, the FAA now has a path for a fully integrated remote ID system to include all sUAS.

Increasingly, operations by law enforcement and public safety agencies are being hindered by drones flown by operators that are unaware of rules and requirements. As such, rescue officials are increasingly required to divert significant resources mid-operation to locate the drone operator hindering the mission. With a remote ID solution that is easy-to-use and integrated into current public safety systems, officials will be able to more quickly and efficiently identify the operator and continue with the mission.

Remote ID will help provide the essentials of both UTM and the overall proliferation of drones. A fully functioning remote ID system will improve safety and security, help the FAA with enforcement and education, and provide public safety agencies with the ability to locate and communicate with a UAS operator when needed, and importantly for UTM, will provide optional situational awareness to Air Traffic Management (ATM).

78 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

While the FAA has been studying the methods for implementation of a remote ID system, it is only with the passing of H.R. 302 that has mandated progress towards a working system. The FAA has identified two broad categories for remote identification and tracking: 1) Direct Broadcasting Solutions; and 2) Network Publishing Solutions.2 Under both methods, data (a unique identifier for the drone, tracking information and drone owner and remote pilot identification) would be transmitted directly to an FAA approved internet-based database.

While the FAA has not determined the exact method of implementation, it has provided a conceptual framework of different identification methods adopted to address the needs of different industry stakeholders. These methods include:

° ID Locations / Sites: Similar to the current method used for the operation of air shows, operators are given approval to operate within a certain location during certain times.

° Control Station / Controller Location: The location of the operator and the drone being controlled is determined based on the controller (i.e., smartphone, tablet, etc.) and broadcast (most likely to LAANC) via mobile network, WiFi, or other communication protocol.

° Unmanned Aircraft (UA) and Control Station: Tracking and identification of the drone and operator directly broadcasted to LAANC. This could enable short BVLOS operations such as around the other side of a building or bridge, as it does not rely on the constant connection between the operator and the drone.

° UA with Location Transmitter and Central Station Location: In addition to tracking and identifying via the drone and the operator, this method would include adding a transmitter to the drone, enabling a direct link of communication over longer distances without “piggybacking” on existing networks.

2 See Imperial Capital’s April 2018 Security Monitor for a description of these solutions.

December 2018 79

Unmanned Aerial Systems Sector Security Industry Monitor

Figure 28: Considering Categories for Remote ID Compliance

Sources: FAA.

Select Remote ID Providers3

° uAvionix: Bigfork, MT-based uAvionix is a provider of automatic dependent surveillance- broadcast (ADS-B) transceivers, receivers, and navigation tools for aircraft remote ID and tracking. Combining hardware, software and real-time airspace information, uAvionix ADS-B transceivers and transponders for UAS are some of the smallest in the world.

Command and Control (C2) / Secure Communications

For safe drone operation – both human and autonomously operated – the C2 link is vital. The link between operator / drone, drone / network and done / drone needs to be reliable and secure. Additionally, spectrum will be required for UAS tracking and identification as well as the transmission of data being collected by the drone. Importantly, any communication protocols being used cannot interfere with current ATM systems.

Currently, most sUASs are controlled using direct RF which limits the distance of operations. BVLOS operations will require connectivity over longer distances, which cannot be covered by these RF solutions. As an established industry with significant communications infrastructure, the cellular network is being looked to as the likely solutions to improving and extending UAS operational distances and data collection and processing. While there have been numerous successful testing flights controlling a drone via 4G cellular network, further development is required. Cellular towers are optimized for communications from ground-to-tower-to-ground while drones operate in a four-dimension environment that could be challenging for some cellular networks. Additionally, with the proliferation of data collection and almost instantaneous transmission to the cloud, we question if the cellular network in place can meet the demand. Lastly, additional C2 security challenges arise once the drone’s communication link is no longer direct controller to aircraft.

3 Note: Many UAS Service Suppliers listed above as well as collision and avoidance technology providers offer remote ID solutions.

80 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Figure 29: Cellular Network Communication

Sources: Ericsson.

Collision Detection and Avoidance

A lingering challenge to UTM and eventual safe BVLOS operation is how a UAS will detect and avoid collisions with property or other aircraft whether manned or unmanned. Manned aircraft include collision warning systems that warn the pilot of a potential collision and as a last line of defense, take automatic action to prevent an accident. UAS are unable to rely on the vision of the operator, thus requiring a robust detection and avoidance solution that is either attached modularly or embedded in the drone. Various technologies including EO/IR, radar, Traffic Alert and Collision Avoidance System and ADS-B.

Many drones currently available to the market have a basic detection and avoidance system for stationary or slow moving large objects. DJI’s Spark and Mavic Air, for example, have embedded cameras and sensors. DJI also offers Guidance, a hardware-based visual sensing system that can be attached to its drones. In February 2018, Skydio released what is believed to be the most sophisticated consumer drone able to fly autonomously following a person and avoid objects using 13 cameras embedded in the drone. While these solutions are sufficient for the consumer to use, fully functioning UTM will require reliable and scalable solutions able to detect and avoid colliding with fast moving aircraft. There are companies (such as Fortem Technologies and Iris Automation) which are currently working on a range of solutions having raised capital from venture capital funds and the corporate venture groups of Tier 1 prime contractors.

December 2018 81

Unmanned Aerial Systems Sector Security Industry Monitor

Figure 30: Collision Detection and Avoidance

Sources: Iris Automation.

Select Collision Detection and Avoidance Technology Providers

° Flarm: Based in Cham, Switzerland, Flarm offers traffic awareness and collision avoidance solutions for general aviation, light aircraft and UAVs. Over 35,000 manned aircraft and many UAVs are equipped with FLARM.

° Fortem Technologies: Headquartered in Pleasant Grove, UT, Fortem Technologies offers AI- enabled airspace security and safety solutions. It provides detect-and-avoid and intrusion detection solutions. Fortem’s TrueView radar can be affixed to sUAS to provide detect and avoid capabilities for BVLOS.

° Iris Automation: San Francisco, CA-based Iris Automation offers collision detection and avoidance solutions. Iris Automation’s systems combine cameras, deep learning, and computer vision technologies to detect moving aircraft and process real-time data to determine the safest course of action to avoid collisions.

° Skydio: Based in Menlo Park, CA, Skydio’s R1 drone uses a combination of cameras, computer vision and motion planning algorithms to autonomously follow a subject while detecting and avoiding potential collisions.

82 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Accident Avoidance / Safe Landing Technologies

As part of its initiative to open-up the NAS to sUAS operations, the FAA is exploring methods to enable safe drone operations over people. Without such mechanisms, drone operations in urban environments will be severely limited. Most drones currently operated have safety systems enabling automatic landing or return to launch point if there’s some break in communications with the operator, but there are few solutions for safe landings in instances of catastrophic failure of systems. In October, the U.K. Civil Aviation Authority (UKCAA) released a safety notice regarding instances where drones from the DJI Matrice 200 Series suffered complete power loss mid-flight despite the indications that there was sufficient battery time remaining. The notice applied to DJI’s Matrice 200 and Inspire 2 drones using specific battery types for those models.4 In each case with the Matrice 200, the aircraft fell directly to the ground with the remote pilot unable to control its flight path. There were no reported injuries, but until further notice, the UKCAA has prohibited flights over people at any altitude.

A widely discussed solution is the addition of an automatic parachute system to a UAS. The FAA recently granted ParaZero, a manufacturer of drone parachutes, the first FAA waiver for the first UAS flight over people with a parachute system. Currently, UAS flights over unprotected people are prohibited.

Figure 31: ParaZero SafeAirTM System

Sources: Parazero Limited.

4 The U.K. CAA safety notice can be found at: http://publicapps.caa.co.uk/modalapplication.aspx?appid=11&mode=detail&id=8915

December 2018 83

Unmanned Aerial Systems Sector Security Industry Monitor

Select Accident Avoidance / Safe Landing Technologies

° Parazero: Based in Kiryat Ono, Israel, Parazero’s SafeAirTM system combines a computer, parachute, flight termination system and audio warning device – all working together to facilitate a safe landing of the drone. The package monitors key flight parameters independently of the UAS’s avionic systems. The system can autonomously identify a critical failure and determine if the flight should be terminated and parachute deployed.

° Fruity Chutes: Based in Monte Sereno, CA, Fruity Chutes is a provider of parachutes for UAVs, remote control aircraft and rocketry. Since 2007, Fruity Chutes has shipped over 4,000 parachute systems.

° Mars Parachutes: Based in Anaheim, CA, Mars Parachutes provides both manual (NOVA) and automatic (MAYDAY) sUAS parachute systems. Customers can choose to combine NOVA and MAYDAY solutions to have an automatic deployment parachute system with a manual backup.

84 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Notable M&A Transactions

The volume of M&A transactions remains low given the UAS market is still in the early growth and many companies are still relatively small.

° PrecisionHawk Inc. acquired HAZON, Inc. and InspecTools Inc. simultaneously, followed by the acquisition of Uplift Data Partners. No amounts were disclosed for the transactions.

On September 5, 2018, PrecisionHawk Inc. acquired HAZON, Inc. a drone services provider focused on critical infrastructure inspections, drone aviation consulting as well as basic and advanced training. HAZON also provides drone fleet management software. Simultaneously, PrecisionHawk Inc. acquired InspecTools Inc., a provider of machine vision software and data analysis tools for inspection in the renewable energy market. The value of the transactions was not disclosed.

On November 2, 2018, PrecisionHawk Inc. acquired Uplift Data Partners, a provider of turnkey drone inspection services for construction, building information management and real estate.

° Platform Aerospace in conjunction with an unnamed partner acquired assets of Vanilla Aircraft for an undisclosed amount

On July 5, 2018, a joint venture between Platform Aerospace and an unnamed partner acquires substantially all the assets Vanilla Aircraft, the designer and builder of the VA001 ultra-endurance UAS.

Registered Direct and Private Placement Snapshot

The commercial UAS sector has experience steady funding with larger capital raises closed by some of the more mature companies in the sector.

° Airobotics Ltd. raised $30 million via Series D funding

On October 31, 2018, Airobotics Ltd., a developer and manufacturer of fully automated UAS’ solutions, raised $30 million via a Series D funding round let by Pavilion Capital. To-date, Airobotics raised a total of $110 million.

° Delair-Tech SAS raised an undisclosed amount via a Series B funding

On September 13, 2018, Delair-Ted SAS, a provider of sUAS and imaging processing technology, raised an undisclosed amount via a Series B funding round from Intel Capital. Prior to Intel Capital’s investment, Delair had raised $28.5 million

° Impossible Aerospace Corp. raised $9.4 million via a Series A funding

On September 11, 2018, Impossible Aerospace Corp., a manufacturer of battery electric flight products, raised $9.4 million via a Series A funding round led by Bessemer Venture Partners with participation from Airbus Ventures.

December 2018 85

Unmanned Aerial Systems Sector Security Industry Monitor

° SkyX Systems Corp. raised $9.5 million via a Series B funding

On September 7, 2018, SkyX Systems Corp., a developer and manufacturer of fully autonomous long- range fixed-wing UAS, raised $9.5 million via a Series B funding round led by Almond Tree Enterprise Inc.

° Auterion AG raised $10.0 million via seed funding

On September 4, 2018, Auterion AG, a provider of an open source operating system for drones, raised $10 million via a seed funding round with participation from Lakestar, Tectonic Ventures, Costanoa Ventures and Mosic Ventures.

° 5x5 Technologies Inc. raised $4.4 million via Private Placement

On August 13, 2018, 5x5 Technologies Inc., a maker of software for analytics as well as hardware for the integration of drones into the national airspace, raised $4.4 million via a Private Placement from an unnamed investor, according to SEC filings.

° DroneDeploy raised $25.0 million via Series C funding

On June 28, 2018, DroneDeploy, a provider of cloud-based drone software solutions, raised $25.0 million via a Series C funding round led by Invenergy Future Fund.

° Matternet Inc. raised $16.0 million via Series A funding

On June 26, 2018, Matternet Inc., a maker of an on-demand drone delivery solution for urban and rural environments, raised $16.0 million via a Series A funding round led by Boeing HorizonX Ventures.

° CyPhy Works Inc. raised $4.6 million via debt financing

° On June 14, 2018, CyPhy Works Inc., a developer and manufacturer of tethered UAS for use in public safety and inspection, raised $4.6 million in debt financing

° Propeller Aerobotics Pty Ltd. raised $10.0 million via Series A funding

On June 13, 2018, Propeller Aerobotics Pty Ltd, a provider of drone analytics solutions for the heavy civil construction and resources markets, raised $10.0 million via a Series A funding round led by Blackbird Ventures.

° Verity Studios AG raised $18.0 million via Series A funding

On June 13, 2018, Verity Studios AG, a provider of technology for autonomous indoor drones, raised $18.0 million via a Series A funding round led by Fontinalis Partners with participation from Airbus Ventures and Kitty Hawk among others.

86 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

° Kittyhawk.io, Inc. raised $8.0 million via Seed funding

On June 6, 2018, Kittyhawk.io, Inc., a provider of enterprise drone flight management and operations solutions raised $5.0 million via a seed funding round led by Bonfire Ventures with participation by Boeing HorizonX Ventures and The Flying Projection, among others.

Subsequently, on October 4, 2018, Kittyhawk.io, Inc. raised an additional $3 million strategic investment from The Travelers Companies, Inc.

° Uavia SAS raised €2 million via Seed funding

On April 25, 2018, Uavia SAS, a maker of cloud technology that enables remote supervision of autonomous robots and drone fleets, raised €2 million via a seed funding round led by Airbus Ventures.

Bankruptcies

There has been one notable bankruptcy during 2Q18 and one start-up wind down during 3Q18.

° Airware Inc. closed in 3Q18 after raising a total of $118 million

On September 14, 2018, Airware Inc. a provider of cloud-based drone software for enterprises, announced on its website it will wind down operations. According to the company, “Unfortunately, the market took longer to mature than we expected. As we worked through the various required pivots to position ourselves for long term success, we ran out of financial runway.” Up to the announcement, Airware had raised a total of $118 million from investors including Caterpillar, GV, GE Ventures, KCPB, Andreessen Horowitz, Intel Capital and First Round Capital.

On October 30, 2018, Delair-Tech SAS announced it had acquired key assets of Airware including its Paris- based Redbird team. Redbird, a provider of drone data analytics software, was acquired by Airware in 2016 and will be integrated with Delair’s engineering and customer success operations.

° CybAero AB (OM:CBA) filed for bankruptcy in 2Q18

In June 2018, CybAero AB, a maker of UAS for use in military, law enforcement and commercial operations, filed for bankruptcy with Linköpings District Court in Sweden following the Nasdaq First North exchange halting trading of the company’s securities on June 15. CybAero’s bankruptcy was the result of the company’s need for additional capital as well as Sweden’s Inspectorate of Strategic Products reversing a decision that granted CybAero clearance to export an unmanned helicopter system demonstrator to China.

December 2018 87

Unmanned Aerial Systems Sector Security Industry Monitor

[This page intentionally left blank.]

88 December 2018

Security Industry Monitor Unmanned Aerial Systems Sector

Section VI

Appendix

December 2018 89

Unmanned Aerial Systems Sector Security Industry Monitor

[This page intentionally left blank.]

90 December 2018

Security Industry Monitor Appendix

Comparable Companies Figure 32: Select Security Industry Comparable Companies Ticker Company Name Ticker Company Name TSX:ABT Absolute Software Corporation NASDAQ:IDSY I.D. Systems, Inc. NASDAQNM:ACXM Acxiom Corporation NasdaqCM:INVE Identiv, Inc. TASE:AFHL AFCON Holdings Ltd. NASDAQCM:ISNS Image Sensing Systems, Inc. NasdaqGS:AKAM Akamai Technologies, Inc. SEHK:8051 CircuTech International Holdings Limited NasdaqGS:ALRM Alarm.Com Holdings, Inc. OTCPK:IWSY ImageWare Systems, Inc. TSX:AF AlarmForce Industries Inc. NASDAQ:IMPV Imperva, Inc. NYSE:ALLE Allegion plc AIM:IND IndigoVision Group plc NASDAQ:AOBC American Outdoor Brands Corporation ENXTPA:INSD Inside Secure S.A. NASDAQNM:ALOG Analogic Corporation NasdaqGS:INTC Intel Corporation NYSE:AXE Anixter International Inc. NYSE:IBM International Business Machines Corporation OTCBB:ANVS ANV Security Group, Inc. NASDAQNM:INTX Intersections Inc. NasdaqCM:APDN Applied DNA Sciences, Inc. OTCBB:ISCI ISC8 Inc. NasdaqGM:ARTX Arotech Corporation NASDAQ:ITRN Location and Control Ltd. NASDAQGS:ASCM.A Ascent Capital Group, Inc. NYSE:JCI Johnson Controls International plc OM:ASSA B ASSA ABLOY AB (publ) GTSM:5251 JSW Pacific Corporation TSEC:8072 AV TECH Corporation NYSE:JNPR Juniper Networks, Inc. TSEC:3669 AVer Information Inc. NasdaqGS:KTOS Kratos Defense & Security Solutions, Inc. OTCPK:AVGT.F AVG Technologies N.V. NYSE:LLL L3 Technologies, Inc. TSX:AVO Avigilon Corporation OM:LOOM B Loomis AB (publ) OM:AXIS Axis AB (publ) OTCPK:MACE Mace Security International, Inc. NASDAQGS:AAXN Axon Enterprise, Inc. NASDAQNM:MAGS Ltd. NYSE:CUDA Barracuda Networks, Inc. DB:MBQ Mobotix AG XTRA:BSL Basler Aktiengesellschaft NYSE:MSI Motorola Solutions, Inc. NASDAQ:BKYI BIO-key International, Inc. NYSE:MSA MSA Safety Incorporated NASDAQNM:CA CA, Inc. TSXV:NTS Nanotech Security Corp. NASDAQGS:CAVM Cavium, Inc. NASDAQNM:NSSC Napco Security Technologies, Inc. NASDAQNM:CHKP Software Technologies Ltd. TSE:6701 NEC Corporation SHSE:600654 China Security & Fire Co.,Ltd NASDAQNM:UEPS Net 1 UEPS Technologies, Inc. OTCPK:CBRI.Q Ciber, Inc. AIM:NWT Newmark Security plc NasdaqGS:CSCO Cisco Systems, Inc. NASDAQ:OTIV On Track Innovations Ltd. NasdaqGS:CTXS Citrix Systems, Inc. NYSE:ORCL Oracle Corporation AMEX:MOC Command Security Corporation TASE:ORAD Orad Ltd. TSX:CSU Constellation Software Inc. NASDAQNM:OSIS OSI Systems, Inc. NasdaqGS:CTRL Control4 Corporation NYSE:PANW Palo Alto Networks, Inc. NYSE:CXW CoreCivic, Inc. NASDAQ:PNTR Ltd. OTCPK:CSTI Costar Technologies, Inc. OM:PREC Precise Biometrics AB NYSE:CTS CTS Corporation NasdaqGM:PFPT Proofpoint, Inc. NasdaqGS:CYBR CyberArk Software Ltd. BME:PSG Prosegur Compañía de Seguridad, S.A. NasdaqCM:CYRN CYREN Ltd. ASX:QTG Q Technology Group Limited NYSE:DHR Danaher Corporation LSE:QQ. QinetiQ Group plc NYSE:DBD Diebold Nixdorf, Incorporated NasdaqGS:QLYS Qualys, Inc. NASDAQNM:DMRC Digimarc Corporation NasdaqGS:RDWR Ltd. NasdaqCM:DGLY Digital Ally, Inc. AMEX:RWC RELM Wireless Corporation SWX: DOKA dormakaba Holding AG NYSE:ROP Roper Technologies, Inc. GTSM:5489 DynaColor, Inc. ENXTPA:SAF Safran SA TSEC:5484 EverFocus Electronics Corporation ENXTPA:SU Schneider Electric S.E. LSE:EXPN Experian plc TSE:9735 SECOM CO., LTD. NASDAQGS:FFIV F5 Networks, Inc. OM:SECU B Securitas AB NYSE:FSS Federal Signal Corporation SZSE:002528 Shenzhen Infinova Limited OM: FING B Fingerprint Cards AB (publ) DB:SIE Siemens Aktiengesellschaft NasdaqGS:FEYE FireEye, Inc. LSE:SMIN Smiths Group plc NASDAQNM:FLIR FLIR Systems, Inc. NasdaqGS:SPLK Splunk Inc. NasdaqGS:FTNT Fortinet, Inc. NYSE:SWK Stanley Black & Decker, Inc. NYSE:FBHS Fortune Brands Home & Security, Inc. OTCBB:SFOR StrikeForce Technologies, Inc. LSE:GFS G4S plc NasdaqGS:SYMC Symantec Corporation ENXTAM:GTO Gemalto N.V. TSEC:9925 Taiwan Shin Kong Security Co.,Ltd. TSEC:3356 GeoVision Inc. NYSE:BCO The Brink's Company AMEX:GSB GlobalSCAPE, Inc. NYSE:GEO The GEO Group, Inc. OTCPK:GRDH Guardian 8 Holdings NasdaqGS:KEYW The KEYW Holding Corporation NasdaqGM:GUID Guidance Software, Inc. NYSE:TMO Thermo Fisher Scientific Inc. OM:GUNN Gunnebo AB TSE:4704 Trend Micro Incorporated SZSE:002415 Hangzhou Hikvision Digital Technology Co., Ltd. NASDAQNM:TRMB Trimble Inc. NYSE:HON Honeywell International Inc. NYSE:TYL Tyler Technologies, Inc. NYSE:HPQ HP Inc. NASDAQGS:UBNT Ubiquiti Networks, Inc. (Continued on next page)

December 2018 91

Appendix Security Industry Monitor

Ticker Company Name Ticker Company Name NYSE:UTX United Technologies Corporation TSEC:3454 Vivotek Inc NasdaqGS:VRNS Varonis Systems, Inc. NYSE:VMW VMware, Inc. NASDAQSC:VDSI VASCO Data Security International, Inc. TSEC:6131 Yoko International Corp. NYSE:PAY VeriFone Systems, Inc. NASDAQNM:ZBRA Zebra Technologies Corporation NASDAQGS:VRNT Verint Systems Inc. SZSE:002236 Zhejiang Dahua Technology Co., Ltd. AMEX:VSR Versar, Inc. BSE:531404 Zicom Electronic Security Systems Limited AMEX:VII Vicon Industries, Inc. NasdaqGS:ZIXI Zix Corporation Sources: Imperial Capital, LLC.

Figure 33: Physical Security Sector—Select Comparable Companies Ticker Company Name Ticker Company Name TASE:AFHL AFCON Holdings Ltd. NYSE:JCI Johnson Controls International plc TSX:AF AlarmForce Industries Inc. GTSM:5251 JSW Pacific Corporation NYSE:ALLE Allegion plc NasdaqGS:KTOS Kratos Defense & Security Solutions, Inc. NASDAQNM:ALOG Analogic Corporation NYSE:LLL L3 Technologies, Inc. NYSE:AXE Anixter International Inc. OM:LOOM B Loomis AB (publ) OTCBB:ANVS ANV Security Group, Inc. OTCPK:MACE Mace Security International, Inc. NASDAQ:AOBC American Outdoor Brands Corporation NASDAQNM:MAGS Magal Security Systems Ltd. NasdaqGM:ARTX Arotech Corporation DB:MBQ Mobotix AG NASDAQGS:ASCM.A Ascent Capital Group, Inc. NYSE:MSA MSA Safety Incorporated OM:ASSA B ASSA ABLOY AB (publ) NASDAQNM:NSSC Napco Security Technologies, Inc. TSEC:8072 AV TECH Corporation AIM:NWT Newmark Security plc TSEC:3669 AVer Information Inc. TASE:NICE NICE Ltd. TSX:AVO Avigilon Corporation TASE:ORAD Orad Ltd. OM:AXIS Axis AB (publ) NASDAQNM:OSIS OSI Systems, Inc. NASDAQGS:AAXN Axon Enterprise, Inc. NASDAQ:PNTR Pointer Telocation Ltd. XTRA:BSL Basler Aktiengesellschaft CATS:PSG Prosegur Compañía de Seguridad, S.A. AMEX:MOC Command Security Corporation ASX:QTG Q Technology Group Limited TSX:CSU Constellation Software Inc. LSE:QQ. QinetiQ Group plc NasdaqGS:CTRL Control4 Corporation AMEX:RWC RELM Wireless Corporation NYSE:CXW CoreCivic, Inc. NYSE:ROP Roper Technologies, Inc. OTCPK:CSTI Costar Technologies, Inc. ENXTPA:SU Schneider Electric S.E. NYSE:CTS CTS Corporation TSE:9735 SECOM CO., LTD. NYSE:DHR Danaher Corporation OM:SECU B Securitas AB NYSE:DBD Diebold Nixdorf, Incorporated SZSE:002528 Shenzhen Infinova Limited NasdaqCM:DGLY Digital Ally, Inc. DB:SIE Siemens Aktiengesellschaft SWX: DOKA dormakaba Holding AG LSE:SMIN Smiths Group plc GTSM:5489 DynaColor, Inc. NYSE:SWK Stanley Black & Decker, Inc. TSEC:5484 EverFocus Electronics Corporation TSEC:9925 Taiwan Shin Kong Security Co.,Ltd. NYSE:FSS Federal Signal Corporation SEHK:8051 CircuTech International Holdings Limited NASDAQNM:FLIR FLIR Systems, Inc. NYSE:BCO The Brink's Company NYSE:FBHS Fortune Brands Home & Security, Inc. NYSE:GEO The GEO Group, Inc. LSE:GFS G4S plc NYSE:TMO Thermo Fisher Scientific Inc. TSEC:3356 GeoVision Inc. NASDAQNM:TRMB Trimble Inc. OTCPK:GRDH Guardian 8 Holdings NYSE:TYL Tyler Technologies, Inc. OM:GUNN Gunnebo AB NASDAQGS:UBNT Ubiquiti Networks, Inc. SZSE:002415 Hangzhou Hikvision Digital Technology Co., Ltd. NYSE:UTX United Technologies Corporation NYSE:HON Honeywell International Inc. NASDAQGS:VRNT Verint Systems Inc. NASDAQ:IDSY I.D. Systems, Inc. AMEX:VSR Versar, Inc. NASDAQCM:ISNS Image Sensing Systems, Inc. AMEX:VII Vicon Industries, Inc. OTCPK:IMSC.Q (Invalid Identifier) TSEC:3454 Vivotek Inc AIM:IND IndigoVision Group plc TSEC:6131 Yoko International Corp. OTCBB:ISCI ISC8 Inc. SZSE:002236 Zhejiang Dahua Technology Co., Ltd. NASDAQ:ITRN Ituran Location and Control Ltd. BSE:531404 Zicom Electronic Security Systems Limited Sources: Imperial Capital, LLC.

92 December 2018

Security Industry Monitor Appendix

Figure 34: Identity Solutions Sector—Select Comparable Companies Ticker Company Name Ticker Company Name NYSE:MMM 3M Company OTCPK:IWSY ImageWare Systems, Inc. NASDAQNM:ACXM Acxiom Corporation ENXTPA:INSD INSIDE Secure NasdaqCM:APDN Applied DNA Sciences, Inc. NASDAQNM:INTX Intersections Inc. TSX:AVO Avigilon Corporation TSXV:NTS Nanotech Security Corp. NASDAQ:BKYI BIO-key International, Inc. NASDAQNM:UEPS Net 1 UEPS Technologies, Inc. NASDAQNM:DMRC Digimarc Corporation NASDAQ:OTIV On Track Innovations Ltd. LSE:EXPN Experian plc OM:PREC Precise Biometrics AB NasdaqGS:FEYE FireEye, Inc. ENXTPA:SAF Safran SA ENXTAM:GTO Gemalto N.V. NASDAQSC:VDSI VASCO Data Security International, Inc. NasdaqCM:INVE Identiv, Inc. NASDAQNM:ZBRA Zebra Technologies Corporation Sources: Imperial Capital, LLC.

Figure 35: Information Security Sector—Select Comparable Companies Ticker Company Name Ticker Company Name NasdaqGS:AKAM Akamai Technologies, Inc. NYSE:IBM International Business Machines Corporation OTCPK:AVGT.F AVG Technologies N.V. OTCPK:ISCI ISC8 Inc. NYSE:CUDA Barracuda Networks, Inc. NYSE:JNPR Juniper Networks, Inc. NASDAQNM:CA CA, Inc. NYSE:MSI Motorola Solutions, Inc. NASDAQGS:CAVM Cavium, Inc. TSE:6701 NEC Corporation NASDAQNM:CHKP Check Point Software Technologies Ltd. NYSE:ORCL Oracle Corporation OTCPK:CBRI.Q Ciber, Inc. NYSE:PANW Palo Alto Networks, Inc. NasdaqGS:CSCO Cisco Systems, Inc. NasdaqGM:PFPT Proofpoint, Inc. NasdaqGS:CTXS Citrix Systems, Inc. NasdaqGS:QLYS Qualys, Inc. NasdaqGS:CYBR CyberArk Software Ltd. NasdaqGS:RDWR Radware Ltd. NasdaqCM:CYRN CYREN Ltd. NYSE:SSNI Silver Spring Networks, Inc. NASDAQGS:FFIV F5 Networks, Inc. NasdaqGS:SPLK Splunk Inc. NasdaqGS:FEYE FireEye, Inc. OTCBB:SFOR StrikeForce Technologies, Inc. NasdaqGS:FTNT Fortinet, Inc. NasdaqGS:SYMC Symantec Corporation AMEX:GSB GlobalSCAPE, Inc. NasdaqGS:KEYW The KEYW Holding Corporation NasdaqGM:GUID Guidance Software, Inc. TSE:4704 Trend Micro Incorporated NYSE:HPQ HP Inc. NasdaqGS:VRNS Varonis Systems, Inc. NASDAQ:IMPV Imperva, Inc. NYSE:VMW VMware, Inc. NasdaqGS:INTC Intel Corporation NasdaqGS:ZIXI Zix Corporation Sources: Imperial Capital, LLC.

December 2018 93

Appendix Security Industry Monitor

[This page intentionally left blank.]

94 December 2018

Security Industry Monitor Appendix

Valuations—Security Industry Companies

Physical Security Companies

Figure 36: Large Industrials ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical Security - Large Industrials UTX United Technologies Corp. $122.81 85.2% $106,032.2 $134,445.2 $64,137.0 25.9 16.6 2.1 2.3 2.2 12.7 13.5 12.5 18.5 2.5 1.8 SIE Siemens AG 116.79 81.9 94,608.4 119,238.3 96,484.3 29.9% 11.0% 1.2x 1.4x 1.2x 11.2x 11.0x 9.2x 13.7x 2.0x 1.8 HON Honeywell International Inc. 147.17 87.7 108,948.2 115,730.2 42,916.0 31.7% 20.9% 2.7x 2.9x 2.9x 12.9x 15.0x 13.8x 20.7x 0.7x 2.3 DHR Danaher Corp. 108.01 97.4 75,704.5 85,557.9 19,615.2 56.2 24.8 4.4 5.1 4.7 17.6 20.9 20.0 27.1 2.0 2.5 SU Schneider Electric SA 73.12 82.0 40,168.7 48,962.3 29,036.3 38.6 16.2 1.7 1.9 1.6 10.4 12.2 10.1 15.2 1.5 1.7 JCI Johnson Controls Inc. 34.77 83.7 32,129.5 44,218.5 31,400.0 29.9 15.0 1.4 1.9 1.4 9.4 15.3 9.2 13.3 2.3 1.4 ROP Roper Industries Inc. 296.42 94.8 30,659.0 35,511.5 5,041.5 62.9 34.5 7.0 9.4 7.7 20.4 27.2 22.3 N/M 2.8 2.2 SWK Stanley Black & Decker, Inc. 131.19 74.3 19,817.6 25,443.6 13,592.5 36.5 16.4 1.9 2.2 2.0 11.4 13.6 11.1 17.7 2.2 1.6 ASSA B Assa Abloy AB 18.75 86.9 20,823.1 24,049.7 9,110.6 39.6 17.5 2.6 3.1 2.6 15.0 19.0 14.2 19.8 2.0 2.3 ALLE Allegion Plc 92.21 97.8 8,765.1 10,030.2 2,652.4 43.4 22.9 3.8 4.5 4.2 16.5 20.9 18.1 24.4 2.1 1.5 DOKA dorma + kaba Holding AG 725.75 75.3 3,038.9 3,752.8 2,859.5 42.0 15.1 1.3 1.6 1.3 8.7 11.3 8.5 24.3 1.6 1.9

Mean 86.1% 39.7% 19.2% 2.7x 3.3x 2.9x 13.3x 16.4x 13.5x 19.5x 2.0x 1.9 Median 85.2% 38.6% 16.6% 2.1x 2.3x 2.2x 12.7x 15.0x 12.5x 19.2x 2.0x 1.8 Note: Tyco International Ltd. was acquired by Johnson Controls Inc. on Jan 25, 2016 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 95 2017 Security Industry Monitor Appendix

Physical Security Companies, continued

Figure 37: Public Safety and Justice ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical Security - Public Safety & Justice MSI Motorola Solutions, Inc. $132.63 99.1% $21,688.7 $26,297.7 $7,046.0 48.0% 25.7% 3.7x 4.4x 4.1x 14.5x 17.1x 15.7x 24.5x 2.5x 2.0 LLL L-3 Communications Holdings Inc. 181.36 81.1 14,272.6 17,192.6 10,047.0 12.2 13.9 1.7 1.9 1.8 12.3 14.7 12.9 N/M 2.0 1.6 CSU Constellation Software Inc. 710.69 82.6 15,060.6 15,003.8 2,917.1 36.7 14.0 5.1 7.1 6.1 36.8 36.8 31.6 N/M N/M 1.6 TYL Tyler Technologies Inc. 193.21 76.5 7,501.0 7,229.2 910.8 47.1 21.3 7.9 9.6 8.6 37.3 45.4 37.4 N/M N/M 2.9 GEO The GEO Group, Inc. 23.47 83.6 2,856.0 5,528.6 2,300.9 25.1 17.2 2.4 N/A N/A 14.0 14.5 14.1 19.2 6.8 3.2 CXW Corrections Corporation of America 21.95 84.1 2,605.1 4,276.4 1,794.1 28.5 22.8 2.4 2.3 2.4 10.5 9.1 10.4 11.6 4.1 2.6 FSS Federal Signal Corp. 22.91 80.9 1,380.2 1,567.4 1,057.7 25.7 13.9 1.5 2.2 1.7 10.6 19.6 14.6 22.2 1.3 1.3 QQ. QinetiQ Group Plc 3.79 97.9 2,122.5 1,795.4 1,123.0 15.8 16.8 1.6 N/A 1.6 9.5 N/A 8.8 17.7 N/M 56.1 KTOS Kratos Defense & Security Solutions, Inc. 13.60 84.5 1,411.2 1,518.0 768.5 27.4 7.6 2.0 2.3 2.0 26.1 N/M 36.7 N/M 1.8 N/A

Mean 85.6% 29.6% 17.0% 3.2x 4.2x 3.5x 19.1x 22.5x 20.2x 19.1x 3.1x 8.9 Median 83.6% 27.4% 16.8% 2.4x 2.3x 2.2x 14.0x 17.1x 14.6x 19.2x 2.3x 2.3 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 96

Security Industry Monitor Appendix

Physical Security Companies, continued

Figure 38: Security Equipment ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical Security - Security Equipment 002415 Hangzhou Hikvision Digital Technology $4.19 64.6% $38,638.1 $37,096.6 $6,984.9 44.2% 24.1% 5.3x 8.2x 5.8x 22.0x 37.6x 22.4x 26.0x N/M 1.0 ASSA B ASSA ABLOY AB 18.75 86.9 20,823.1 24,049.7 9,110.6 39.6 17.5 2.6 3.1 2.6 15.0 19.0 14.2 19.8 2.0 2.3 ALLE Allegion Plc 92.21 97.8 8,765.1 10,030.2 2,652.4 43.4 22.9 3.8 4.5 4.2 16.5 20.9 18.0 24.4 2.1 1.5 FBHS Fortune Brands Home & Security, Inc. 42.75 58.1 6,045.1 8,170.3 5,446.9 36.1 15.2 1.5 1.6 1.5 9.9 10.5 9.6 13.9 2.6 1.2 SMIN Smiths Group plc 18.22 78.9 7,212.9 8,404.8 4,213.0 45.6 18.6 2.0 2.1 1.8 10.7 11.2 9.7 13.7 1.5 2.4 FLIR FLIR Systems, Inc. 45.80 71.7 6,336.3 6,200.3 1,822.0 50.0 22.6 3.4 3.7 3.4 15.1 17.5 16.1 24.6 N/M 2.6 UBNT Ubiquiti Networks, Inc. 111.92 97.4 7,927.9 7,829.5 1,053.9 43.8 32.8 7.4 10.1 8.3 22.6 28.3 25.6 N/M N/M 1.8 002236 Zhejiang Dahua Technology Co.,Ltd. 2.01 45.2 6,021.2 6,201.8 3,225.0 36.3 13.3 1.9 3.3 2.2 14.5 29.5 13.5 15.5 0.3 0.7 MSA Mine Safety Appliances 106.85 96.4 4,109.9 4,333.9 1,342.5 45.1 20.8 3.2 3.8 3.6 15.5 20.8 18.0 N/M 0.8 1.4 DOKA dorma + kaba Holding AG 725.75 75.3 3,038.9 3,752.8 2,859.5 42.0 15.1 1.3 1.6 1.3 8.7 11.3 8.7 24.3 1.6 1.9 AXE Anixter International Inc. 62.34 70.2 2,087.3 3,281.1 8,294.9 19.6 4.8 0.4 0.4 0.4 8.3 8.8 8.6 12.4 3.0 1.4 DBD Diebold, Incorporated 3.14 16.4 238.6 2,503.2 4,538.7 22.0 4.5 0.6 0.8 0.5 12.1 11.2 8.6 2.9 10.1 NM CTS CTS Corporation 29.18 74.4 965.5 911.1 461.3 33.6 15.3 2.0 2.3 2.2 12.9 12.2 14.2 25.3 N/M 1.1 AOBC Smith & Wesson Holding Corporation 12.12 76.0 659.2 828.6 616.7 33.7 15.4 1.3 0.9 1.2 8.7 3.1 7.7 15.5 1.8 1.1 CTRL Control4 Corporation 21.06 56.0 562.5 472.6 268.7 51.9 11.3 1.8 2.3 1.9 15.5 28.5 20.1 18.5 N/M 1.3 002528 Infinova 0.58 72.0 698.6 741.1 545.2 23.1 3.5 1.4 2.6 1.7 38.8 N/M N/M N/M 2.1 N/A GUNN Gunnebo AB 2.74 66.6 208.7 345.2 690.5 27.9 7.4 0.5 0.5 0.5 6.7 5.8 6.1 12.6 2.7 N/A NSSC Napco Security Systems Inc. 16.12 90.9 299.5 292.0 93.9 41.6 11.2 3.1 3.4 3.3 27.8 35.9 35.5 N/M N/M N/A AFHL AFCON Holdings Ltd. 50.93 91.2 233.3 318.3 426.1 12.6 5.2 0.7 0.9 0.7 14.3 14.9 13.0 N/M 3.8 N/A 3454 Vivotek Inc 3.41 91.7 287.7 277.8 177.3 36.1 8.6 1.6 1.9 1.4 18.2 13.7 14.0 19.7 N/M N/A MBQ Mobotix AG 9.25 77.6 121.6 140.6 80.6 53.8 N/M 1.7 1.8 1.8 N/M N/M N/M N/M N/M N/A IDSY ID Systems Inc. 6.25 77.6 113.2 101.4 52.7 47.9 N/M 1.9 2.8 2.5 N/M N/M N/M N/M N/M NM 5489 DynaColor, Inc. 1.24 93.8 122.1 97.2 70.2 34.5 12.0 1.4 1.6 1.3 11.5 11.2 9.2 N/M N/M N/A 3356 Geovision, Inc. 1.11 79.2 99.1 107.5 49.2 34.7 N/M 2.2 1.8 2.0 N/M 14.6 N/M N/M N/M N/A MAGS Magal Security Systems Ltd. 5.25 81.0 120.9 75.5 89.5 45.2 8.9 0.8 1.1 1.2 9.5 21.5 N/M N/M N/M N/A 531404 Zicom Electronic Security Systems Limited 0.11 24.9 4.4 103.8 18.2 34.1 N/M 5.7 0.8 2.1 N/M 13.5 N/M N/M N/M N/A 3669 AVer Information Inc. 0.56 75.8 52.1 24.6 67.6 46.9 4.4 0.4 0.4 0.4 8.3 3.6 5.2 N/M N/M N/A DGLY Digital Ally Inc. 2.91 58.7 30.3 31.9 11.8 33.9 N/M 2.7 1.9 2.2 N/M N/M N/M N/M N/M N/A ISNS Image Sensing Systems, Inc. 5.55 82.2 29.3 25.7 15.3 84.2 17.2 1.7 1.8 1.8 9.8 23.1 9.7 N/M N/M N/A CSTI Costar Technologies, Inc 10.99 92.4 17.1 26.0 47.3 39.5 7.7 0.5 0.7 0.6 7.1 13.0 6.9 N/M 2.4 N/A MACE Mace Security International Inc. 0.35 69.0 21.7 22.1 11.6 44.2 2.8 1.9 2.4 2.2 N/M N/M N/M N/M 1.3 N/A 8072 Av Tech Corporation 0.73 82.5 58.3 17.3 29.6 18.0 N/M 0.6 0.4 0.5 N/M 13.7 32.3 N/M N/M N/A 6131 Yoko Technology Corp. 0.45 54.5 45.4 18.0 1.2 35.1 N/M 15.6 4.6 14.4 N/M N/M N/M N/M N/M N/A 5484 EverFocus Electronics Corporation 0.17 72.9 19.3 9.6 14.6 3.5 N/M 0.7 0.3 0.5 N/M 16.1 N/M N/M N/M N/A 5251 JSW Pacific Corporation 0.55 71.6 19.5 8.3 12.8 29.9 N/M 0.7 0.4 0.7 N/M 3.9 N/M N/M N/M N/A IND IndigoVision Group plc 1.47 82.1 10.8 8.1 44.3 56.9 N/M 0.2 0.2 0.2 N/M 11.7 N/M N/M N/M N/A

Mean 73.7% 38.1% 13.2% 2.3x 2.2x 2.3x 14.4x 16.2x 14.5x 17.9x 2.5x 1.6 Median 75.9% 37.9% 12.6% 1.7x 1.8x 1.8x 12.9x 13.7x 13.3x 18.5x 2.1x 1.4 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 97 2017 Security Industry Monitor Appendix

Physical Security Companies, continued

Figure 39: Explosives Detection and Security Sensors ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical Security - Explosives Detection & Security Sensors TMO Thermo Fisher Scientific, Inc. $251.84 99.2% $101,384.8 $119,240.8 $23,898.0 44.4% 24.9% 5.0x 6.5x 5.7x 20.1x 26.2x 22.7x 26.9x 3.0x 2.0 LLL L-3 Communications Holdings Inc. 181.36 81.1 14,272.6 17,192.6 10,047.0 12.2 13.9 1.7 1.9 1.8 12.3 14.7 12.9 21.8 2.0 1.6 SMIN Smiths Group plc 18.22 78.9 7,212.9 8,404.8 4,213.0 45.6 18.6 2.0 2.1 1.8 10.7 11.2 9.7 13.7 1.5 2.4 MSA Mine Safety Appliances Co. 106.85 96.4 4,109.9 4,333.9 1,342.5 45.1 20.8 3.2 3.8 3.6 15.5 20.8 18.0 N/M 0.8 1.4 QQ. QinetiQ Group Plc 3.79 97.9 2,122.5 1,795.4 1,123.0 15.8 16.8 1.6 N/A 1.6 9.5 N/A 8.8 16.2 N/M 56.1 OSIS OSI Systems, Inc. 71.29 83.6 1,294.1 1,627.0 1,098.4 36.1 13.9 1.5 1.8 1.6 10.6 13.0 9.3 20.1 2.2 1.1 QTG Q Technology Group 0.01 50.0 0.7 1.5 9.5 20.1 N/M 0.2 0.1 0.2 N/M N/M N/M N/M N/M N/A

Mean 83.9% 31.3% 18.2% 2.2x 2.7x 2.3x 13.1x 17.2x 13.6x 19.7x 1.9x 10.8 Median 83.6% 36.1% 17.7% 1.7x 2.0x 1.8x 11.5x 14.7x 11.3x 20.1x 2.0x 1.8 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

Figure 40: Alarm Monitoring ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical Security - Alarm Monitoring PSG Prosegur Compañía de Seguridad, S.A. $5.18 63.9% $3,099.3 $3,799.4 $4,572.2 25.1 11.9 0.8 0.9 0.7 7.0 8.0 6.2 15.1 1.1 1.1 ASCM.A Ascent Capital Group, Inc. 0.86 6.7 10.6 1,754.6 539.5 75.9 50.1 3.3 3.1 3.2 6.5 5.7 6.0 N/M 6.5 N/A

Mean 35.3% 50.5% 31.0% 2.0x 2.0x 2.0x 6.7x 6.9x 6.1x 15.1x 3.8x 1.1 Median 35.3% 50.5% 31.0% 2.0x 2.0x 2.0x 6.7x 6.9x 6.1x 15.1x 3.8x 1.1 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 98

Security Industry Monitor Appendix

Physical Security Companies, continued

Figure 41: Guard Services / Cash-in-Transit ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical Security - Guard Services 9735 Secom Co. Ltd. $83.40 96.4% $18,202.8 $15,561.0 $8,765.7 31.8% 19.2% 1.8x 2.0x 1.8x 9.2x 9.7x 9.0x 24.7x N/M 4.0 SECU B Securitas AB 16.63 91.6 6,071.5 7,916.1 11,099.1 17.7 6.5 0.7 0.8 0.7 10.9 12.7 11.0 16.2 2.5 1.2 GFS G4S plc 2.42 64.6 3,745.2 5,877.5 9,934.6 17.7 6.7 0.6 0.6 0.6 8.8 8.3 7.3 9.8 3.2 1.4 GEO The GEO Group, Inc. 23.47 83.6 2,856.0 5,528.6 2,300.9 25.1 17.2 2.4 N/A N/A 14.0 14.5 14.1 18.6 6.8 3.2 BCO Brinks Co. 68.22 77.4 3,452.8 4,678.7 3,484.4 22.1 11.6 1.3 1.5 1.4 11.6 15.6 12.5 22.9 3.0 1.2 PSG Prosegur Compañía de Seguridad, S.A. 5.18 63.9 3,099.3 3,799.4 4,572.2 25.1 11.9 0.8 0.9 0.7 7.0 8.0 6.2 15.1 1.1 1.1 LOOM B Loomis AB 33.66 85.2 2,532.2 3,060.0 2,088.9 26.5 17.8 1.5 1.7 1.5 8.2 9.3 7.8 14.4 1.4 1.7 MOC Command Security Corp. 2.82 79.4 28.6 37.4 178.7 11.1 1.3 0.2 0.2 0.2 16.5 N/M 24.9 N/M 3.9 N/A

Mean 80.3% 22.1% 11.5% 1.1x 1.1x 1.0x 9.8x 10.0x 9.7x 17.4x 3.1x 2.0 Median 81.5% 23.6% 11.7% 1.1x 0.9x 0.7x 9.2x 9.5x 9.0x 16.2x 3.0x 1.4 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 99 2017 Security Industry Monitor Appendix

Identity Solutions Companies

Figure 42: Intelligent Video ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Identity Solutions - Intelligent Video Companies 002415 Hangzhou HIKvision Digital Technology $4.19 64.6% $38,638.1 $37,096.6 $6,984.9 NA 24.1% 5.3x 8.2 5.8x 22.0x 37.6 22.4 26.0x N/M 1.0 7751 Canon Inc. 28.38 72.9 30,647.6 32,167.3 35,369.3 47.2 15.5 0.9 1.1 0.9 5.9 7.8 5.8 13.9 N/M 1.7 FLIR FLIR Systems Inc. 45.80 71.7 6,336.3 6,200.3 1,822.0 50.0 22.6 3.4 3.7 3.4 15.1 17.5 16.1 24.6 N/M 2.6 002236 Zhejiang Dahua Technology Co.,Ltd. 2.01 45.2 6,021.2 6,201.8 3,225.0 NA 13.3 1.9 3.3 2.2 14.5 29.5 13.5 15.5 0.3 0.7 VRNT Verint Systems Inc. 44.94 85.7 2,916.9 3,321.3 1,195.0 64.8 11.9 2.8 3.1 2.9 23.3 34.1 29.8 16.3 2.7 1.6 002528 Infinova 0.58 72.0 698.6 741.1 545.2 23.1 3.5 1.4 2.6 1.7 38.8 N/M N/M N/M 2.1 N/A BSL Balsar AG 166.46 64.1 537.1 529.7 169.0 48.8 19.3 3.1 5.1 2.9 16.2 34.4 12.9 20.9 N/M NM 3454 Vivotek Inc 3.41 91.7 287.7 277.8 177.3 36.1 8.6 1.6 1.9 1.4 18.2 13.7 14.0 19.7 N/M N/A MBQ Mobotix AG 9.25 77.6 121.6 140.6 80.6 53.8 9.8 1.7 1.8 1.8 17.8 N/M N/M N/M 2.4 N/A 3356 Geovision, Inc. 1.11 79.2 99.1 107.5 49.2 34.7 N/M 2.2 1.8 2.0 N/M 14.6 N/M N/M N/M N/A DGLY Digital Ally Inc. 2.91 58.7 30.3 31.9 11.8 33.9 N/M 2.7 1.9 2.2 N/M N/M N/M N/M N/M N/A ISNS Image Sensing Systems 5.55 82.2 29.3 25.7 15.3 84.2 17.2 1.7 1.8 1.8 9.8 23.1 9.7 N/M N/M N/A CSTI Costar Technologies, Inc 10.99 92.4 17.1 26.0 47.3 39.5 7.7 0.5 0.7 0.6 7.1 13.0 6.9 N/M 2.4 N/A IND IndigoVision Group plc 1.47 82.1 10.8 8.1 44.3 56.9 N/M 0.2 0.2 0.2 N/M 11.7 N/M N/M N/M N/A

Mean 74.3% 47.7% 14.0% 2.1x 2.2x 2.1x 17.1x 17.6x 13.2x 19.6x 2.0x 1.5 Median 75.3% 48.0% 13.3% 1.9x 1.9x 2.0x 17.0x 14.6x 13.5x 19.7x 2.4x 1.6 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 100

Security Industry Monitor Appendix

Identity Solutions Companies, continued

Figure 43: Chinese Video Companies ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Identity Solutions - Chinese Video Companies 002415 Hangzhou HIKvision Digital Technology $4.19 64.6% $38,638.1 $37,096.6 $6,984.9 24.1% 5.3x 8.2 5.8 22.0x 37.6 22.4 3.6x N/M 1.0 002236 Zhejiang Dahua Technology Co.,Ltd. 2.01 45.2 6,021.2 6,201.8 3,225.0 13.3 1.9 3.3 2.2 14.5 29.5 13.5 2.3 0.3 0.7 002528 Infinova 0.58 72.0 698.6 741.1 545.2 3.5 1.4 2.6 1.7 38.8 N/M N/M 5.2 2.1 N/A 5388 Sercomm 2.12 72.5 499.2 417.1 1,122.6 4.4 0.4 0.4 0.3 8.4 6.1 6.2 0.6 N/M N/A 9925 Taiwan Shin Kong Security Co. Ltd. 1.12 87.7 425.2 300.1 230.8 18.9 1.3 1.3 1.3 6.9 7.0 6.6 0.5 N/M N/A 3454 Vivotek Inc 3.41 91.7 287.7 277.8 177.3 8.6 1.6 1.9 1.4 18.2 13.7 14.0 0.7 N/M N/A 5489 DynaColor, Inc. 1.24 93.8 122.1 97.2 70.2 12.0 1.4 1.6 1.3 11.5 11.2 9.2 0.5 N/M N/A 3356 Geovision, Inc. 1.11 79.2 99.1 107.5 49.2 N/M 2.2 1.8 2.0 N/M 14.6 N/M 17.2 N/M N/A 3669 AVer Information Inc. 0.56 75.8 52.1 24.6 67.6 4.4 0.4 0.4 0.4 8.3 3.6 5.2 14.4 N/M N/A 8051 TeleEye Holdings Ltd. 0.99 48.9 23.3 18.6 39.0 N/M 0.5 6.8 1.5 N/M N/M N/M N/M N/M N/A 8072 AV Tech Corporation 0.73 82.5 58.3 17.3 29.6 N/M 0.6 0.4 0.5 N/M 13.7 32.3 N/M N/M N/A 6131 Yoko Technology Corp. 0.45 54.5 45.4 18.0 1.2 N/M 15.6 4.6 14.4 N/M N/M N/M 0.4 N/M N/A 5484 EverFocus Electronics Corporation 0.17 72.9 19.3 9.6 14.6 N/M 0.7 0.3 0.5 N/M 16.1 N/M N/M N/M N/A 5251 JSW Pacific Corporation 0.55 71.6 19.5 8.3 12.8 N/M 0.7 0.4 0.7 N/M 3.9 N/M N/M N/M N/A

Mean 72.4% 11.2% 1.4x 1.6x 1.5x 12.8x 10.8x 11.0x 4.6x 1.2x 0.9 Median 72.7% 10.3% 1.3x 1.5x 1.3x 11.5x 12.5x 9.2x 1.5x 1.2x 0.9 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 101 2017 Security Industry Monitor Appendix

Identity Solutions Companies, continued

Figure 44: Products ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Identity Solutions - Products MMM 3M Company $207.64 79.9% $120,906.1 $132,308.1 $32,810.0 49.5% 25.9% 4.0x 4.4x 4.2x 15.5x 15.4x 14.9x 22.9x 1.3x 2.2 SAF Safran SA 126.89 91.4 52,376.3 57,436.4 21,537.7 45.4 17.3 2.7 3.3 2.8 15.4 14.9 13.6 24.0 1.3 1.5 ITW Illinois Tool Works 135.65 75.8 45,008.9 50,827.9 14,817.0 41.7 27.4 3.4 3.7 3.6 12.5 14.4 13.2 20.7 1.4 1.9 ASSA B Assa Abloy AB 18.75 86.9 20,823.1 24,049.7 9,110.6 39.6 17.5 2.6 3.1 2.6 15.0 19.0 14.2 19.8 2.0 2.3 ZBRA Zebra Technologies 179.60 97.2 9,663.3 11,521.3 4,107.0 46.5 19.1 2.8 3.2 3.1 14.7 19.5 17.7 26.1 2.4 1.3 GTO Gemalto 57.41 99.6 5,207.9 5,949.6 3,460.0 33.6 12.2 1.7 1.8 1.7 14.1 10.3 13.9 21.7 1.8 1.5 BRC Brady Corp. 42.68 90.1 2,239.7 2,101.9 1,176.9 50.0 15.5 1.8 1.9 1.8 11.5 13.4 12.8 23.2 N/M 2.0 DLAR De La Rue 6.02 71.5 620.0 753.4 661.2 47.0 13.8 1.1 N/A N/A 8.3 N/A N/A 10.5 1.3 N/A UEPS Net 1 Ueps Technologies 5.23 39.8 297.2 424.0 586.2 48.4 16.0 0.7 0.7 0.7 4.5 2.7 3.3 3.2 0.4 0.3 DMRC Digimarc 20.47 51.2 233.6 184.2 20.8 53.5 N/M 8.8 8.5 7.3 N/M N/M N/M N/M N/M N/A FING B Fingerprint Cards AB 1.33 64.9 416.3 332.8 194.2 2.6 N/M 1.7 0.5 0.9 N/M 1.2 9.7 14.6 N/M N/A PREC Precia Société Anonyme 215.74 74.2 118.7 109.8 148.2 76.7 11.0 0.7 0.9 0.7 6.7 8.7 6.6 N/M N/M N/A INSD INSIDE Secure 2.10 59.3 92.6 61.7 46.9 92.4 21.7 1.3 1.2 1.6 6.1 5.4 9.0 22.6 N/M N/A INVE Identive Group 5.09 74.1 78.7 77.6 73.4 38.2 N/M 1.1 1.4 1.3 N/M N/M N/M N/M N/M N/A IWSY ImageWare Systems 0.75 33.5 72.6 71.5 4.6 78.9 N/M 15.7 18.8 16.7 N/M N/M N/M N/M N/M N/A PREC Precise Biometrics AB 0.14 59.3 49.2 39.0 7.6 88.9 N/M 5.1 4.2 5.2 N/M 13.3 N/M N/M N/M N/A APDN Applied DNA Sciences Inc. 1.05 37.5 31.6 29.1 3.9 68.1 N/M 7.6 7.7 6.5 N/M N/M N/M N/M N/M N/A NTS Nanotech Security Corp. 0.56 48.7 38.6 31.4 6.7 79.5 12.7 4.7 20.3 4.4 37.0 N/M 28.6 N/M N/M N/A OTIV On Track Innovations 0.72 24.4 29.7 24.3 25.2 51.2 1.5 1.0 1.2 1.1 N/M N/M N/M N/M N/M N/A IGP Intercede Group 0.40 71.6 20.3 21.7 12.7 99.7 N/M 1.7 2.1 1.8 N/M N/M N/M N/M N/M N/A BKYI BIO-key International 1.34 36.8 18.7 17.7 5.4 NA N/M 3.3 5.9 2.8 N/M N/M N/M N/M N/M N/A DSS Document Security Systems 0.97 30.8 16.4 16.5 18.4 NA 0.3 0.9 0.9 0.9 N/M 22.5 13.8 N/M 2.1 N/A

Mean 63.6% 56.6% 15.1% 3.4x 4.6x 3.4x 13.4x 12.4x 13.2x 19.0x 1.6x 1.6 Median 68.2% 49.8% 15.7% 2.2x 3.1x 2.6x 13.3x 13.4x 13.6x 21.7x 1.4x 1.7 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 102

Security Industry Monitor Appendix

Identity Solutions Companies, continued

Figure 45: Location Technologies ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Identity Solutions - Location & Tracking TRMB Trimble Navigation Ltd. $37.98 83.1% $9,538.6 $11,346.1 $3,030.4 56.9% 17.3% 3.7x 4.8x 4.3x 21.7x 29.2x 25.2x 26.0x 3.5 1.4 GRMN Garmin Ltd. 67.70 95.7 12,782.4 11,552.3 3,278.1 58.5 25.0 3.5 3.8 3.7 14.1 16.3 15.3 23.3 N/M 3.3 MANH Manhattan Associates, Inc. 49.34 79.1 3,225.5 3,131.6 558.9 57.6 27.2 5.6 5.2 5.3 20.6 15.4 15.8 26.4 N/M N/A TOM2 TomTom NV 9.46 91.5 2,186.0 2,025.7 1,001.0 67.6 19.0 2.0 1.9 1.9 10.7 17.7 14.9 N/M N/M N/A CAMP CalAmp Corp. 17.70 69.5 559.6 523.6 379.0 40.8 8.2 1.4 1.6 1.5 16.9 13.5 12.5 15.6 N/M 1.0 ITRN Ituran Location & Control Ltd. 33.75 91.9 707.7 748.3 234.7 51.1 30.8 3.2 3.7 3.2 10.4 12.5 10.7 16.5 0.4 1.4 USAT USA Technologies 4.70 27.9 282.0 305.4 128.2 28.0 7.5 2.4 3.6 2.6 31.7 N/M 40.0 N/M 2.1 N/A DGII Digi International 11.60 78.9 318.6 255.9 228.4 48.9 8.3 1.1 1.3 1.4 13.5 12.4 23.4 N/M N/M 3.0 ABT Absolute Software Corporation 6.44 98.2 260.1 225.5 94.9 84.9 8.8 2.4 2.5 2.4 27.1 N/M 49.4 N/M N/M N/A IDSY ID Systems 6.25 77.6 113.2 101.4 52.7 47.9 N/M 1.9 2.8 2.5 N/M N/M N/M N/M N/M NM PNTR Pointer Telocation Ltd. 11.65 59.3 94.7 93.0 78.2 52.8 16.8 1.2 1.4 1.2 7.1 9.2 7.0 11.5 N/M N/A LTRX Lantronix 3.00 46.4 66.2 47.3 47.3 56.1 4.4 1.0 1.1 1.1 22.7 N/M N/M N/M N/M N/A UBI Ubisense Group 0.87 79.1 63.4 61.7 33.3 41.2 N/M 1.9 1.9 1.7 N/M N/M N/M N/M N/M N/A IMP Intermap Technologies Corp. 0.13 26.2 2.2 30.1 17.5 N/M 21.5 1.7 4.3 1.6 8.0 N/M 9.2 N/M 7.4 N/A

Mean 71.7% 53.3% 16.2% 2.4x 2.9x 2.4x 17.0x 15.8x 20.3x 19.9x 3.3x 2.0 Median 79.0% 52.8% 17.1% 2.0x 2.6x 2.2x 15.5x 14.5x 15.3x 19.9x 2.8x 1.4 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

Figure 46: Services ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Identity Solutions - Services EXPN Experian $24.83 97.7% $22,305.1 $25,745.1 $4,819.0 42.3% 30.5% 5.3x N/A 5.6x 17.5x N/A 16.8x 27.7x 2.3x 2.6 VRSN VeriSign 158.11 89.4 19,113.7 19,719.1 1,203.0 84.1 66.4 16.4 17.3 16.9 24.7 26.5 24.5 N/M 0.8 N/A FICO Fair Isaac Corporation 195.72 81.2 5,667.1 6,341.0 1,032.5 69.9 22.7 6.1 7.0 6.7 27.1 31.7 27.8 N/M 2.9 3.2 EGOV NIC 12.92 68.4 860.1 679.0 349.7 41.5 25.0 1.9 2.1 2.0 7.8 8.2 7.9 16.6 N/M N/A PAY VeriFone Systems 10.94 78.9 746.3 702.8 289.7 44.6 27.6 2.4 2.7 2.5 8.8 9.9 8.6 13.0 N/M 4.6 INTX Intersections 3.64 99.5 88.9 101.8 155.2 68.2 3.6 0.7 0.6 0.6 18.2 21.1 N/A N/M 2.3 N/A WYY WidePoint 0.47 64.4 39.4 35.8 78.8 18.2 1.8 0.5 0.5 0.5 24.6 N/M N/A N/M N/M N/A

Mean 82.8% 52.7% 25.4% 2.8x 2.6x 3.0x 21.2x 19.2x 16.6x 19.1x 2.1x 3.5 Median 81.2% 44.6% 25.0% 2.2x 2.1x 2.2x 21.4x 21.1x 16.8x 16.6x 2.3x 3.2 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 103 2017 Security Industry Monitor Appendix

Information Security Companies

Figure 47: Information Security Pure Plays ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Information Security Pure Plays PANW Palo Alto Networks $178.19 74.4% $16,907.0 $15,327.6 $2,427.3 71.7% 1.0 6.3 9.8 7.7 N/M N/M N/M N/M N/M 1.5 CHKP Check Point Software 112.31 93.0 17,544.4 15,774.2 1,896.9 89.5 49.9 8.3 9.1 8.5 16.6 18.2 16.8 21.4 N/M 2.2 SYMC Symantec 22.40 75.3 14,311.1 16,914.1 4,750.0 78.6 20.3 3.6 4.5 3.6 17.5 22.3 26.0 15.4 2.7 1.4 FTNT Fortinet 75.12 79.6 12,798.2 11,164.0 1,710.8 75.0 14.3 6.5 8.8 7.5 45.5 N/M N/M N/M N/M 2.1 FFIV F5 Networks 174.95 87.6 10,606.7 9,567.3 2,161.4 83.3 30.6 4.4 4.7 4.6 14.5 15.7 15.1 20.7 N/M 1.9 4704 Trend Micro 56.89 85.3 7,935.5 6,537.7 1,401.1 80.3 32.5 4.7 5.8 4.9 14.4 16.8 14.6 N/M N/M N/A PFPT Proofpoint 95.19 73.1 5,201.9 5,011.6 661.0 71.4 N/M 7.6 13.3 9.7 N/M N/M N/M N/M N/M 3.0 PKT Qualys 79.34 80.7 3,124.3 2,797.8 267.6 76.4 28.3 10.5 14.1 12.1 36.9 N/M 48.3 N/M N/M 2.4 FEYE FireEye, Inc. 20.04 97.2 3,879.8 3,742.4 790.7 66.0 N/M 4.7 5.2 5.0 N/M N/M N/M N/M N/M 16.0 CYBR CyberArk Software, Ltd. 74.85 88.9 2,699.2 2,312.7 314.5 85.1 13.2 7.4 10.7 8.8 N/M N/M N/M N/M N/M 2.0 VRNS Varonis Systems, Inc. 58.02 69.8 1,709.5 1,551.5 257.7 90.0 N/M 6.0 9.4 7.1 N/M N/M N/M N/M N/M N/A IMPV Imperva 55.53 96.3 1,954.3 1,649.9 351.8 79.5 1.4 4.7 6.2 5.1 N/M N/M N/M N/M N/M 4.4 RDWR Radware 22.64 79.4 1,025.4 725.6 229.0 81.8 4.5 3.2 3.7 3.4 N/M N/M N/M N/M N/M 2.8 ZIXI Zix Corporation 6.38 90.0 345.8 321.8 68.8 79.0 20.7 4.7 5.4 4.9 22.5 27.7 24.0 22.8 N/M 1.1 AVG AVG Technologies 0.37 75.9 104.4 161.5 195.7 25.1 8.8 0.8 1.0 0.8 9.3 14.2 9.2 21.7 3.3 N/A WYN Wynyard Group Limited 5.32 80.3 105.2 114.7 565.8 13.6 2.7 0.2x 0.3x 0.2x 7.4x 9.3x 7.5x 11.4x 0.6x N/A GSB GlobalSCAPE 4.65 98.1 83.6 72.4 33.9 81.6 6.2 2.1 2.2 2.1 34.5 13.2 25.1 N/M N/M N/A

Mean 83.8% 72.2% 16.8% 5.0x 6.7x 5.7x 21.9x 17.2x 20.7x 18.9x 2.2x 3.4 Median 80.7% 79.0% 13.8% 4.7x 6.0x 5.1x 16.6x 16.2x 16.8x 21.0x 2.7x 2.1 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 104

Security Industry Monitor Appendix

Information Security Companies, continued

Figure 48: Diversified Technology Leaders ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Diversified Technology Leaders CSCO Cisco Systems, Inc. $48.92 98.9% $219,920.0 $202,972.0 $50,266.0 62.2 30.0 4.0 4.2 4.2 13.5 13.8 14.1 20.3 N/M 2.2 ORCL Oracle Corp. 49.99 93.5 189,375.1 188,077.1 39,920.0 79.7 40.5 4.7 5.1 4.8 11.6 12.2 11.9 17.3 N/M 1.8 IBM International Business Machines Corp. 123.89 72.4 112,590.5 145,306.5 80,373.0 45.5 21.1 1.8 1.9 1.9 8.6 7.8 8.8 9.0 1.9 1.3 HPQ Hewlett-Packard Company 23.61 87.2 37,357.2 37,478.2 58,472.0 18.2 8.3 0.6 0.8 0.7 7.7 8.8 8.3 14.0 0.0 1.2 6701 NEC Corp. 30.30 96.0 7,871.8 11,276.8 25,491.1 28.0 5.9 0.4 0.5 0.4 7.5 8.8 7.6 17.3 1.2 6.4 JNPR Juniper Networks, Inc. 29.07 94.4 10,033.6 8,782.9 4,706.0 59.1 17.9 1.9 1.8 1.7 10.4 7.9 7.6 13.9 N/M 1.3

Mean 90.4% 48.8% 20.6% 1.4x 2.1x 1.4x 9.2x 9.1x 8.8x 15.3x 1.1x 2.4 Median 93.9% 52.3% 19.5% 1.8x 1.8x 1.7x 8.6x 8.8x 8.3x 15.6x 1.2x 1.6 Enterprise value is defined as market capitalization plus net debt, minority interest, and preferred equity. . Italicized, NA, and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC filings.

December 2018 105 2017 Security Industry Monitor Appendix

Government and Integration Services Companies

Figure 49: Government Services ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Government Services BA The Boeing Company $352.74 89.5% $200,315.9 $202,281.9 $96,943.0 18.8 13.0 2.1 2.1 2.2 16.1 23.3 16.7 N/M 0.1 1.4 LMT Lockheed Martin Corporation 292.94 80.7 83,319.7 97,207.7 54,283.0 11.6 13.5 1.8 2.1 1.9 13.3 16.0 14.8 22.4 1.9 1.7 GD General Dynamics Corp 178.14 77.5 52,754.7 64,825.7 34,092.0 19.0 14.3 1.9 2.1 2.1 13.3 15.5 14.0 18.2 2.5 1.5 NOC Northrop Grumman Corp 256.41 71.1 44,517.8 58,194.8 28,290.0 22.9 16.6 2.1 2.4 2.3 12.4 15.9 15.4 19.5 2.9 1.0 SAF Safran SA 126.89 91.4 52,376.3 57,436.4 21,537.7 45.4 17.3 2.7 3.3 2.8 15.4 14.9 13.6 24.0 1.3 1.5 RTN Raytheon Corp 170.70 74.3 48,578.2 52,118.2 26,481.0 24.8 14.0 2.0 2.2 2.1 14.1 13.9 13.7 22.3 0.8 1.3 LSE:BA. BAE Systems plc 6.03 69.5 19,267.2 21,831.0 23,181.1 63.1 10.3 0.9 1.0 0.9 9.1 10.0 8.6 10.3 1.0 N/A HRS Harris Corp 141.25 80.5 16,619.3 20,323.3 6,314.0 36.3 23.2 3.2 3.4 3.4 13.9 14.3 15.0 25.0 2.5 N/A LDOS Leidos Holdings, Inc. 61.06 84.5 9,144.3 11,687.3 10,063.0 12.8 10.1 1.2 1.7 1.1 11.5 18.3 11.4 16.5 2.5 1.5 LSE:SMIIN Smiths Group plc 18.22 78.9 7,212.9 8,404.8 4,213.0 45.6 18.6 2.0 2.1 1.8 10.7 11.2 9.7 13.7 1.5 2.4 CACI CACI International Inc 160.83 80.1 3,996.5 5,016.9 4,547.9 33.6 9.7 1.1 1.2 1.1 11.3 13.5 13.5 23.9 2.3 1.7 MMS MAXIMUS Inc 71.52 98.4 4,586.5 4,219.5 2,392.2 24.8 14.7 1.8 1.7 1.7 12.0 11.1 11.3 22.2 N/M 1.9 MANT ManTech International Corp 55.45 81.4 2,203.2 2,188.2 1,923.8 14.5 8.4 1.1 1.4 1.3 13.6 17.8 16.5 N/M N/M 3.4 EGL Engility Holdings, Inc. 30.32 78.7 1,120.9 1,984.2 1,901.1 14.5 9.1 1.0 1.0 1.0 11.4 10.4 10.8 13.8 4.9 3.0 QQ. QinetiQ Group plc 3.79 97.9 2,122.5 1,795.4 1,123.0 15.8 16.8 1.6 N/A 1.6 9.5 N/A 8.8 16.2 N/M 56.1 ICFI ICF International Inc 70.30 85.5 1,325.0 1,551.7 1,281.2 36.3 8.7 1.2 1.3 1.3 13.9 13.9 13.8 23.4 2.0 1.4 KTOS Kratos Defense & Security Solutions 13.60 84.5 1,411.2 1,518.0 768.5 27.4 7.6 2.0 2.3 2.0 26.1 N/M 36.7 N/M 1.8 N/A UIS Unisys Corp 13.21 63.1 674.0 840.1 2,808.9 23.2 10.3 0.3 0.3 0.3 2.9 5.0 4.7 9.6 0.5 N/A KEYW The KEYW Holding Corporation 9.83 98.3 487.2 752.0 507.5 25.6 8.4 1.5 2.6 1.7 17.7 28.8 20.9 N/M 6.2 N/A ARTX Aerotech Corporation 2.76 66.5 72.1 81.0 102.0 29.0 8.0 0.8 0.9 0.8 10.0 14.1 12.4 17.8 1.1 N/A

Mean 81.6% 27.2% 12.6% 1.6x 1.8x 1.7x 12.9x 14.9x 14.1x 18.7x 2.1x 5.7 Median 80.6% 24.8% 11.7% 1.7x 2.1x 1.7x 12.8x 14.2x 13.6x 18.8x 1.9x 1.6 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 106

Security Industry Monitor Appendix

Government and Integration Services Companies, continued

Figure 50: Security Systems Integration—Diversified

($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Security Systems Integration - Diversified t SIE Siemens AG $116.79 81.9% $94,608.4 $119,238.3 $96,484.3 29.9% 11.0% 1.2x 1.4x 1.2x 11.2x 11.0x 10.1x 13.7x 2.0x 1.8 SU Schneider Electric SE 73.12 82.0 40,168.7 48,962.3 29,036.3 38.6 16.2 1.7 1.9 1.6 10.4 12.2 10.3 15.2 1.5 1.7 JCI Johnson Controls Inc. 34.77 83.7 32,129.5 44,218.5 31,400.0 29.9 15.0 1.4 1.9 1.4 9.4 15.3 9.6 13.3 2.3 1.4 SWK Stanley Black & Decker, Inc. 131.19 74.3 19,817.6 25,443.6 13,592.5 36.5 16.4 1.9 2.2 2.0 11.4 13.6 12.2 17.7 2.2 1.6 GFS G4S Plc 2.42 64.6 3,745.2 5,877.5 9,934.6 17.7 6.7 0.6 0.6 0.6 8.8 8.3 7.3 9.8 3.2 1.4 KTOS Kratos Defense & Security Solutions, Inc 13.60 84.5 1,411.2 1,518.0 768.5 27.4 7.9 2.0 2.3 2.0 25.1 N/M 36.7 N/M 1.8 N/A

Mean 78.5% 30.0% 12.2% 1.5x 1.7x 1.5x 12.7x 12.1x 14.4x 13.9x 2.2x 1.6 Median 81.9% 29.9% 13.0% 1.5x 1.9x 1.5x 10.8x 12.2x 10.2x 13.7x 2.1x 1.6 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 107 2017 Security Industry Monitor Appendix

Unmanned Aircraft Systems

Figure 51: Security / Defense UAS ($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical - Defense UAS BA The Boeing Company $352.74 89.5% $200,315.9 $202,281.9 $96,943.0 18.8 13.0 2.1 2.1 2.2 16.1 23.3 16.7 N/M 0.1 1.4 LMT Lockheed Martin Corporation 292.94 80.7 83,319.7 97,207.7 54,283.0 11.6 13.5 1.8 2.1 1.9 13.3 16.0 14.8 22.4 1.9 1.7 GD Airbus SE 107.04 84.8 83,029.5 85,547.2 80,377.6 13.5 9.1 1.1 1.2 1.1 11.8 48.9 15.9 26.7 0.3 1.0 NOC Northrop Grumman Corporation 256.41 71.1 44,517.8 58,194.8 28,290.0 22.9 16.6 2.1 2.4 2.3 12.4 15.9 15.4 19.5 2.9 1.0 SAF Raytheon Company 170.70 74.3 48,578.2 52,118.2 26,481.0 24.8 14.0 2.0 2.2 2.1 14.1 13.9 13.7 22.3 0.8 1.3 RTN Thales S.A. 121.15 85.7 25,750.8 23,298.4 18,818.3 25.2 12.1 1.2 1.5 1.2 10.3 13.9 11.0 21.4 N/M 1.4 HRS Textron Inc. 55.78 76.5 13,552.4 16,268.4 14,239.0 16.8 10.6 1.1 1.2 1.2 10.7 10.3 11.0 22.6 1.8 1.4 LSE:BA. L3 Technologies, Inc. 181.36 81.1 14,272.6 17,192.6 10,047.0 12.2 13.9 1.7 1.9 1.8 12.3 14.7 12.9 21.8 2.0 1.6 LDOS Leonardo S.p.a. 9.94 72.4 5,711.1 10,039.0 13,615.7 36.2 9.4 0.7 0.8 0.7 7.9 6.5 6.9 11.6 3.4 0.5 LSE:SMIIN FLIR Systems, Inc. 45.80 71.7 6,336.3 6,200.3 1,822.0 50.0 22.6 3.4 3.7 3.4 15.1 17.5 16.1 24.6 N/M 2.6 CACI Ltd. 124.91 87.9 5,340.1 5,889.2 3,615.4 28.3 12.2 1.6 1.8 1.7 13.4 14.6 14.6 21.6 1.2 N/A MANT AeroVironment, Inc. 72.95 60.1 1,721.4 1,431.6 321.9 40.7 18.0 4.4 6.4 5.6 24.7 N/M 29.4 N/M N/M 1.5 MMS Kratos Defense & Security Solutions, Inc. 13.60 84.5 1,411.2 1,518.0 768.5 27.4 7.6 2.0 2.3 2.0 26.1 N/M 36.7 N/M 1.8 N/A

Mean 78.5% 25.3% 13.3% 1.9x 2.3x 2.1x 14.5x 17.8x 16.5x 21.5x 1.6x 1.4 Median 80.7% 24.8% 13.0% 1.8x 2.1x 1.9x 13.3x 14.7x 14.8x 22.1x 1.8x 1.4 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 108

Security Industry Monitor Appendix

Unmanned Aircraft Systems, continued

Figure 52: Counter UAS

($ in millions except stock price) Stock Price % of 52 Market Enterprise LTM LTM Gross LTM EBITDA EV / Sales EV / EBITDA P/E Net Debt / PEG Ticker Company (12/4/2018) Week High Cap Value (EV) Revenue Margin % Margin % LTM CY2016 CY2017 LTM CY2016 CY2017 FY2017 LTM EBITDA CY2018 Physical - Counter UAS t AIR Airbus SE $107.04 84.8% $83,029.5 $85,547.2 $80,377.6 13.5% 9.1% 1.1x 1.2x 1.1x 11.8x 48.9x 15.9x 26.7x 0.3x 1.0 HO Thales S.A. 121.15 85.7 25,750.8 23,298.4 18,818.3 25.2 12.1 1.2 1.5 1.2 10.3 13.9 11.0 21.4 N/M 1.4 LDO Leonardo S.p.a. 9.94 72.4 5,711.1 10,039.0 13,615.7 36.2 9.4 0.7 0.8 0.7 7.9 6.5 6.9 11.6 3.4 0.5 ESLT Elbit Systems Ltd. 124.91 87.9 5,340.1 5,889.2 3,615.4 28.3 12.2 1.6 1.8 1.7 13.4 14.6 14.6 21.6 1.2 N/A D13 Department 13 International Limited 0.03 32.3 16.4 19.9 2.0 22.3 N/M 9.9 N/M 8.9 0.3 N/M N/M N/M 0.1 N/A

Mean 72.6% 25.1% 10.7% 2.9x 1.3x 2.7x 8.7x 21.0x 12.1x 20.3x 1.3x 1.0 Median 84.8% 25.2% 10.7% 1.2x 1.3x 1.2x 10.3x 14.2x 12.8x 21.5x 0.8x 1.0 Enterprise Value is defined as market capitalization plus net debt, minority interest and preferred equity. NA and NM values are excluded from mean and median calculations. Any foreign securities are converted to USD for historical LTM figures as of the filing date, and for the equity price as of the most recent closing date. Sources: Imperial Capital, LLC, Capital IQ, and Company SEC Filings.

December 2018 109 2017

Glossary of Terms SeSecurityndustry Monitor

[This page intentionally left blank.]

110 December 2018

Clean Energy Industry Monitor Glossary of Terms

Important Disclosures

The information contained herein represents a summary of public information. Imperial Capital, LLC neither makes any projections with regard to outcome nor makes any recommendation with respect to investment in or transferability of the securities discussed herein. The information contained herein does not necessarily reflect the independent views of the research department of Imperial Capital, LLC, or any research analyst, which may have contrary views or opinions. This is a collaborative product of Imperial Capital, LLC and may reflect contributions from all departments within the Firm, including the Firm’s corporate finance, institutional research and sales and trading departments. This is not solely a product of the Firm’s institutional research department.

This summary is for information purposes only. Under no circumstances is it to be used or considered as an offer to sell, or a solicitation of an offer to buy any security. While the information contained in this report has been obtained from sources believed to be reliable, we do not represent or guarantee that the summary is accurate or complete, and it should not be relied upon as such. Any references or citations to, or excerpts from, third- party information or data sources (including, but not limited to,

Bloomberg, Capital IQ and IBISWorld) do not and are not intended to

provide financial or investment advice and are not to be relied upon by anyone as providing financial or investment advice. Based on information available to us, prices and opinions expressed in this report reflect judgments as of the date hereof and are subject to change without notice. The securities covered by or mentioned in this report involve substantial risk and should generally be purchased only by investors able to accept such risk. Any opinions expressed assume that this type of investment is suitable for the investor. While this is in circulation, Imperial Capital, LLC or its affiliates may, from time to time, make or quote a market in or make purchases or sales for their own accounts of securities of the issuers described herein. Imperial Capital, LLC or its affiliates may from time to

time perform investment banking or other services for, or solicit

investment banking or other business from, any company mentioned in this report, and therefore Imperial Capital, LLC may have a conflict of interest that could affect the objectivity of this monitor report.

© 2018 Imperial Capital, LLC

December 2018 111

Imperial Capital Locations

Los Angeles 10100 Santa Monica Boulevard Los Angeles, CA 90067 Office: (310) 246-3700

New York 277 Park Avenue New York, NY 10172 Office: (212) 351-9700

London Imperial Capital (International) LLP One Eagle Place London SW1Y 6AF Office: +44 0 207 650 5400

Boston 265 Franklin Street Boston, MA 02110 Office: (617) 478-7600

Chicago 200 South Wacker Drive Chicago, IL 60606 Office: (312) 674-4713

Houston 1330 Post Oak Blvd Houston, TX 77056 Office: (713) 892-5601

Minneapolis 60 South Sixth Street Minneapolis, MN 55402 Office: (612) 692-6900

Palm Beach 3801 PGA Boulevard Palm Beach Gardens, FL 33410 Office: (561) 214-7901

Stamford One Landmark Square Stamford, CT 06901 Office: (203) 428-3300

Tel Aviv Imperial Capital Israel, Ltd. 45 Rothschild Blvd. P.O.B. 29141 Tel Aviv, Israel Office: +972 (54) 720-0999

Copyright © 2018 Imperial Capital, LLC Member SIPC | Member FINRA | Registrant of the MSRB www.imperialcapital.com

1