F-SECURE ANNUAL REPORT 2018 CONTENTS F-SECURE 2018 Key figures . 01 Why invest in F-Secure? . 02 Products and services . .03. Nobody knows cyber security like F-Secure. For three decades, CEO letter . 04 F-Secure has driven innovations in cyber security, defending over BOARD OF DIRECTORS’ REPORT 100,000 companies and millions of people. With unsurpassed Board of Directors’ Report . .06 experience in endpoint protection as well as detection and Key figures . 13 response, F-Secure shields enterprises and consumers against Calculation of key ratios . 14. everything from advanced cyber attacks and data breaches to widespread ransomware infections. FINANCIAL STATEMENTS F-SECURE CONSOLIDATED . 16 Statement of comprehensive income . 16 Statement of financial position . 17 Statement of cash flows . 18 WE ARE Statement of changes in equity . 19 Notes to the Financial Statements . 20 F-SECURE CORPORATION . 41 F-SECURE Income statement . 41. Balance sheet . 42 Cash flow statement . 43 F-Secure’s sophisticated technology combines the power of Notes to the machine learning with the human expertise of its world-renowned parent company Financial Statements . 44 security labs. F-Secure’s security experts perform incident Auditor’s Report . 55 response and forensic investigations on four continents, and its products are sold all over the world by around 200 broadband and NON-FINANCIAL INFORMATION mobile operators and thousands of resellers. Statement of non-financial information . 59 CORPORATE GOVERNANCE Founded in 1988, F-Secure is listed on the Nasdaq Helsinki. F-Secure’s Corporate Governance Statement . 67 Board of directors . 71 Leadership team . 73 Remuneration statement . 76. INFORMATION FOR SHAREHOLDERS Information for shareholders . 79 01 F-SECURE 2018 KEY FIGURES 2018 Revenue & profitability Revenue growth driven by corporate security, MEUR Revenue by region, % 29.8 Revenue 26.7 Rest of 24.2 24.7 24.3 23.8 23.4 23.8 24.0 the world 12% Nordic 20.1 19.4 20.0 North 190.7 18.6 America 9% 35% countries MEUR 16.6 16.9 Adjusted EBITDA 44% Rest of 17.4 Q Q Q Q Q Q Q Q Europe * * MEUR l Corporate security revenue Sales in l Consumer security revenue In 2018 our 100+ countries corporate security revenue grew by 33%* Tens of millions Operations in 100,000+ of consumer customers * Including acquisition of MWR InfoSecurity Corporate customers 29 locations >1,600 employees 02 F-SECURE 2018 WHY INVEST IN F-SECURE? “F-Secure’s DNA is in highly-scalable cyber security software A FRONT RUNNER The demand for cyber security products and services is in rapid growth, driven by the growing business. In addition IN A RAPIDLY number of cyber attacks, the growing number of connected devices, increasing complexity of IT to award-winning GROWING systems, tightening regulations, and increasing significance of geopolitics. In total, the informa- INDUSTRY tion security sector is a USD 100+ billion industry, growing by around 10% annually with many products, we also segments in strong double-digit growth. have a comprehensive offering of managed EXPANDING F-Secure provides a broad range of cyber security products, managed detection and response detection and response PORTFOLIO FUELS services and cyber security consultancy. Our focus in on the fastest growing segments in the industry, such as Endpoint Detection & Response (EDR) and Managed Detection & Response services as well as cyber CROSS-SELLING AND (MDR). Our expanding portfolio continues to offer us opportunities to expand our sales to both NEW SALES new and existing customers. security consulting.” UNIQUE F-Secure’s sophisticated technology combines the power of machine learning with the human Scalability through our partners expertise of our world-renowned security labs into award-winning solutions. We are also one CAPABILITIES of the world’s leading cyber security consulting providers with feet on the ground on four COMBINING CORPORATE SECURITY EXPERTISE & continents, offering us unique visibility into real-life cyber attacks. PRODUCTS & SERVICES TECHNOLOGY IT RESELLERS CYBER SECURITY 6,000+ SERVICES F-Secure’s DNA is in highly-scalable cyber security software business. By leveraging our A STRONG 100,000 Hundreds of large extensive network of partners we can compete in both corporate and consumer markets all companies enterprises SCALABLE BUSINESS over the world. We work with 6000+ IT resellers, and have built the industry’s largest network MODEL SUPPORTED BY of around 200 telecommunications operator partners. A GLOBAL NETWORK CONSUMER SECURITY OF PARNERS PRODUCTS OPERATORS RETAILERS AND 200 globally WEBSHOPS STRONG VALUES, F-Secure has been a front-runner in cyber security for 30 years. We have always put DEDICATED TO an emphasis on strong core values, and we are committed to helping people and businesses fight cyber threats. Improving our customers’ security and resilience, as Tens of millions of consumers OUR CUSTOMERS well as the sustainability of their digital lives or businesses, is what drives our work. 03 F-SECURE 2018 CORPORATE SECURITY In corporate security F-Secure provides a broad range of cyber security products, managed detection and PRODUCTS response services and cyber security consultancy to companies globally with a focus on the mid-market and local enterprises. The majority of revenue comes from product sales through a large network of solution and AND service provider partners. Prediction solutions Prevention solutions SERVICES F-Secure Radar – Vulnerability scanning and management F-Secure Protection Service for Business – Cloud-hosted platform endpoint security phishd – Anti-phishing behavior management platform F-Secure Business Suite – On-site deployed endpoint security F-Secure Cloud Protection for Salesforce – Content level security for Salesforce’s customers Detection & Response solutions Cyber security services F-Secure Rapid Detection & Response – Customer- or F-Secure provides premium consultancy services for all partner-managed EDR solution for detecting and responding areas of cyber security on four continents, including to targeted attacks services such as: F-Secure Rapid Detection & Response Service – Managed – F-Secure Cyber Incident & Resilience Services detection and response service (MDR) providing 24/7 – F-Secure Security Assessments monitoring, alerts within minutes, and gives clear guidance on how to respond – F-Secure Red Team Testing Countercept – Advanced threat hunting and continuous – F-Secure Cyber Risk Management response capabilities against targeted attacks delivered as a managed service (MDR) CONSUMER SECURITY In consumer security the company provides a comprehensive range of endpoint protection, privacy and password management solutions, and security for all the connected devices at home, both separately and as a bundled premium offering F-Secure( TOTAL). The majority of consumer sales comes from the sale of endpoint protection products through the operator channel, but the company also sells consumer products through various online and retail partners, as well as the company’s own web shop. F-Secure SAFE – Easy to use antivirus and F-Secure FREEDOME – VPN that hides your F-Secure KEY – A light and easy password F-Secure SENSE – Protects every device in internet security, including Family rules to let online activity to ensure anonymous and manager, allowing you to store your passwords your connected home while serving as a fast, you set healthy boundaries for your children’s secure internet browsing. securely and access them from any device. technologically advanced wireless router. The device use. required router is sold separately or provided by the operator. 04 CEO letter THE MAJORITY OF OUR B2B BUSINESS IS NOW IN RAPIDLY GROWING MARKETS In 2018, we made the largest acquisition in F-Secure’s history. It was a The acquisition of MWR InfoSecurity, announced in June, was a logical very significant step for our company. MWR InfoSecurity was a perfect step in the implementation of our corporate security growth strategy. In a number of ways F-Secure and MWR are perfect partners for each other. We match for us in terms of strategy, capabilities and culture. Combining both have matching strategies, complementary technologies, a shared deep companies’ industry-leading technologies and world-renowned expertise passion for safeguarding our customers and a culture of trust. Our experts has made F-Secure stronger than ever. This is especially true in the have already cooperated for years before the acquisition, and hence knew important and rapidly growing detection and response market, but also each other’s strengths. F-Secure has developed world-class AI powered applies to cyber security consulting as companies are facing a global and detection technologies, and MWR has innovated industry-leading threat hunting and remote incident response platforms. MWR was also one of the widening expertise gap. As a result, the majority of our corporate security leading providers of cyber security consulting in the world, with hundreds footprint is now in growth markets. of enterprise customers. By bringing these capabilities together, we have created an extremely competitive detection and response offering as we aim for leadership in this market. We intend to be a leader in the detection and response market The fastest growth is now seen in detection and response solutions, and we strengthened our offering with two new solutions during the year: The acquired Countercept for managed detection and response (MDR) – which we plan to integrate with our own MDR solution (RDS), as well as our new endpoint detection and response (EDR) solution. The last six months of the year saw us sign a record number of MDR deals in several countries, and in many industry verticals such as finance, media, energy, defense and critical infrastructure. Our sales pipeline has continued to develop well. I was particularly pleased with the very high customer satisfaction and renewal rates. These serve as strong proof that we are on the right track. We also significantly expanded our cyber security consultancy capabilities, both in terms of expertise and geographical reach. We are now one of the leading providers of cyber security advisory in the world, with a presence CEO on four continents.