The state ofincident response 2021:
It’s time for a confidence boost

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

022

Introduction
There’s a need now more than ever for security organizations to implement
a structured, detailed, and well-practiced incident response plan. As
the Navy SEALs training philosophy goes, “slow is smooth and smoothis fast”—a mantra that can, and arguably should, be adopted by all
security teams. In incident response, speed comes from being prepared
to methodically and efficiently shut down adversaries in cases where they
manage to get past defenses.
The COVID-19 pandemic has brought to light inefficiencies or a lack of
preparedness within security teams. All at once, security teams foundthemselves dealing with an influx of personal devices on the corporate
network, greatly reducing endpoint visibility and expanding the potential
attack surface, at the same time that attack vectors were, and continue tobe, on the rise.
The pandemic also provided security teams with an opportunity to evaluate
their state of preparedness as well as the effectiveness of their incident
response policies to make refinements going forward. To better understandthe state of incident response today and identify areas for improvement,
Kroll, Red Canary, and VMware partnered with Wakefield Research tosurvey 500 security and risk leaders at large organizations—those with morethan $500 million in revenue—on matters related to their cybersecurity
programs, specifically threat detection and incident response.
In this report, we’ll dive into the survey results; present insights andanalysis from cybersecurity experts; and reveal real-world concerns fromorganizations. Finally, we’ll recommend actionable steps organizations cantake to shore up their incident response plans and stroll into this digitallytransformed world with newfound confidence.

“

Reputational damage
should become the driver,as cybercriminals colonize
corporate networks. In
the absence of vigilant
cybersecurity, your digitaltransformation will becommandeered.”

Tom Kellermann
Head of
Cybersecurity Strategy
VMWARE

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

03
3Key takeaways

No organization
is immune to attack

Collaboration between legal
and infosec is inadequate

The vast majority (93%) of organizations suffered
a compromise of data over the past 12 months,
and most security leaders (82%) believe theirorganization remains vulnerable to a cyber attack.

Almost half (47%) of security leaders say their teams
lack clarity about when to engage legal counsel
about a potential incident. Further, at least two infive organizations are ill-equipped to respond to
the full legal requirements of handling a security
incident. Augmenting these struggles, 39% oforganizations are leaving themselves exposed by
not having a cyber liability insurance policy to covercyber incidents and data breaches.

Deficiencies in incident
response persist
Nearly half of organizations (49%) are not equipped
to meet cybersecurity challenges, while others(54%) are wasting valuable time investigating
low-level alerts and slowing down the incident
response process.

Lack of best practices isputting defenses at risk
While most organizations are following bestpractices, the research shows there is room for
improvement. As many as two in five organizations
are failing to perform compliance audits of partners
handling sensitive data (41%) or are lacking an
employee security awareness program (37%).

49%
Nearly half of organizations
lack adequate tools (including
staff and expertise) to detector respond to cyber threats.

Third-party security providers
are integral to organizations’
incident response processes
The majority of security leaders believe thatthird-party providers can help the most withspeeding up containment and response to threats(55%), augmenting in-house expertise (53%), andincreasing automation of processes (50%).

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

04
4

Organizations
are combating
intensifying threats
All aspects of an organization can be impacted by an attack, security leaders
say. Their concerns cover quite a range, some more tangible and easier tospot than others.

“

American cyberspaceis reeling from a cyber
insurgency stoked by thepax mafiosa between the
cybercrime cartels androgue regimes. Counter
incident response is now
occurring 63% of the time

SECURITY LEADERS ARE CONCERNED ABOUT AN ARRAY
OF NEGATIVE IMPACTS FROM CYBER ATTACKS

and destructive attacks
have surged by 118%. 2021
is defined by a renaissance64%

Damage to theorganization’s
reputationin exploit development
and a strategic embraceof island-hopping as thepreferred modus operandi.”

63%
59%
54%
50%
39%
36%

Compromise or lossof sensitive data

Disruptionof operations

Loss of businessor customers

Negative legal andregulatory impact

Damage tophysical propertyHarmto people

Tom Kellermann
Head of
Cybersecurity Strategy
VMWARE

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

05
5The threats are real and have been felt by nearly all organizations. In just thepast year, 93% of organizations have suffered at least one incident that led
to a compromise of data, and nearly half (49%) of these organizations had atleast four such incidents.

“

Many organizations prepare
by conducting a tabletop

While security leaders are clearly aware of the negative impacts that cancome from not having the right security controls in place, there remain gapsthat are leaving organizations susceptible to further serious incidents: Twothirds (66%) of security leaders say that their organization is vulnerable to acyber attack that could disrupt business or lead to a data breach.
Of note, regarding vulnerability, security leaders generally positioned theirorganizations more favorably against their competitors—compared tothe two-thirds of respondents self-identifying as vulnerable, 82% said theaverage organization in their industry is vulnerable to attack.

exercise with a handfulof stakeholders, but when
faced with a real incident
their front-line teams lackclarity to properly classify
and declare an incident
response. Organizations
need to develop andenforce clear-cut escalation

FOOD FOR THOUGHT:
Our survey suggests a certain level of bias in security leaders’perceptions of their own organizations’ security posture, which
could provide a false sense of security and potentially cause
critical problems or gaps in coverage to go overlooked.

frameworks to avoid
costly delays.”
Stacy ScottManaging Director,
Cyber Risk
KROLL

Further, companies with less than $1 billion revenue (71%) are moreconcerned about data compromises and loss of sensitive information thancompanies with more that $1 billion revenue (56%). If revenue is an indicatorof business maturity, this could suggest that more mature organizations
have at their disposal more resources such as legal counsel to help share theburden of responding to a breach and cushion potential fallout.

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

06
6

“

Identifying threats

Over the course of 2020,

Few business functions had to adjust to the COVID-19 crisis as quickly as
security teams. When organizations made the shift to a work-from-home(WFH) model, not only did security teams have to work very quickly toestablish secure connections, but they also had to be on the lookout for
threats targeting remote workers.

as organizations shiftedalready overburdened
staff to build capacity tosupport remote working,threat actors aggressively
exploited weaknesses
exposed in the transition.”

SECURITY LEADERS CITE INCREASING SECURITY CONCERNSOVER THE PAST YEAR

Marc Brawner
Global Head of Managed
Security Services

to57% Exposure
ransomware attacks

KROLL

endpoint
54% Decreased
visibility due to WFH
attacks against
53% Increased
remote desktop/VPNof internal
50% Migration
systems into the cloud

47%
Compromise ofpassword-based/single-factor user credentials

34%

Reduction incybersecurity
budgetT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

07
7
The new risks are diverse and substantial. Exposure to ransomware
attacks has been a high-profile threat for some time and has continued
to grow in prominence over the last year, according to 57% of security
leaders. Prior to the remote work surge brought on by COVID-19, tools likenetwork-based threat detection and web proxy filters were traditionallyimplemented on premises at a corporate location. Now, security teams
are staring down a proliferation of employee-owned endpoints that areaccessing the corporate network and causing visibility challenges. The
reduction in endpoint visibility due to working from home has become anincreased concern for most security leaders (54%). Elsewhere, increased
attacks against remote desktop services (53%) and the migration of internal
systems to the cloud (50%) have also become greater threats.
Nearly half (47%) of security leaders pointed to identity compromise
through password-based/single-factor user credentials as a growing areaof concern for their organization. However, this has long been a commonlyused attack vector, made attractive to adversaries simply because gaining
access to a system as an authorized user is much more efficient thanattempting to target the built-in security of operating systems. We also
commonly see a remote desktop or other service exposed to the internetwith single-factor authentication serve as the initial entry point for anadversary, then leading to lateral movement and ultimately ransomware.

FOOD FOR THOUGHT:
The fact that such a large portion of the respondent base sees
identity compromise through password-based/single-factor user
credentials as a growing area of concern shows that this pain
point has not been adequately addressed yet. Strong identity
protection, including multi-factor authentication, remains a vital
tool in slowing adversaries.

“

There is nothing more
effective at slowing down
or stopping an adversary
than strong identity
protection, including multifactor authentication. It
doesn’t prevent all attacks,
but it would prevent an
overwhelming majority.”
Keith McCammon
Chief Security Officer& Co-founder
RED CANARYT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

08
8

49%

Internal obstacles
hindering security
While security leaders attempt to deal with heightened external risks,
they are also facing substantial internal obstacles. For example, despite
escalating threats, 45% of organizations surveyed said that their security
spending will stay the same or decrease over the next 12 months. Resources
continue to be a challenge, and these organizations will be required to do
more to respond to the changing threat landscape with existing resources.
POSITIVE+
55%

About half of security leaders
say their organization lacks
adequate tools to prevent,detect, or respond to threats

46%
More than four in 10 say they do
not have adequate staffing on
their security team

Increase cybersecurity spending over next year

52%
Regular security readiness with leadership

NEGATIVE

44%
More than four in 10 say thestaff they do have lack adequate
expertise

47%

Security processes seen as impediment42%
Lack of organization-wide support

42%
Information security program meets
only minimum requirements

41%
Leadership doesn’t
understand initiatives

Security leaders also say they lack resources to properly address threats,
so in some cases, the decision by an organization to not increase theirspending will only exacerbate glaring weaknesses.

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

09
9Difficulty adhering
to best practices
While many security leaders are following best practices, there is ample
room for improvement in this area.

41%

As many as two in five security
leaders are failing to implement
compliance audits of partners
and vendors who handle
sensitive data, making theorganization more vulnerable
to third-party data breaches.

TIP
Ahead of an incident, it’s
important to develop an
information security programthat helps build a defensible
narrative, including
statements like:“We have performed athreat-based assessment
focused on the type of data
we store and transact.”“We’ve taken reasonablemeasures to protect ourdata from the threats thatare most prevalent to ourtype of business.”

29%

Nearly one-third don’t havea formalized information
security strategy at all.

If a large percentage of security programs are not auditing third-party
vendors for compliance, they’re also likely not auditing them for security
concepts such as secure development lifecycle. This could be a critical error
because if an adversary pulls off a software supply chain attack on one ofyour third-party vendors, then you and all of their other customers are atrisk—and likely the intended targets.
Introducing best practices and formal strategies won’t automatically makean organization more secure, but it will provide a clear structure, enablingeasier measurement of security processes’ effectiveness.

“If an attacker does get
into our network, theywould have to takeextraordinary measures
to bypass our security.”
Andrew Beckett
Cyber Risk Practice
Leader, EMEAKROLLT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

10Room for progress
Rate of adoption for best practices remains low:71%
Formalized
information
security strategy

64%
Structured incident
response process

63%
Employee security
awareness program

63%
Adherence tocybersecurity
framework

59%
Compliance audits ofpartners & vendors

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

11Incident response canbe overwhelming
Many organizations are wasting valuable resources on inefficient
processes, with the majority (54%) of security teams spending too muchtime investigating low-level security alerts. It’s no surprise that security
teams are pressed for time when most (70%) are bombarded with 100 or
more cybersecurity threat alerts every day. Some of the most exposedorganizations are also inundated with alerts: 25% of organizations that
had more than three data compromises in the last 12 months are receiving
more than 500 alerts a day. Many of the alerts are either innocuous or
not examined at all, as most (79%) security teams at all organizations areinvestigating up to 20 threat events daily.
Weaknesses are evident elsewhere in the process. Only 8% of security
leaders are fully confident that their organization could identify the root
cause of an attack. The inability to determine the root cause can make it
difficult to track threat movements and could hamper detection of whatmalicious activity is occuring, by whom, and in what network segments.

8%of security leaders are fully
confident that their organization
could identify the root cause of
an attack.

70%of organizations are bombarded
with over 100 cyber threat alerts
every day.

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

12

Responding to incidents
It’s imperative that processes are in place enabling triage of potential threat
activity—but this requires resources to accurately sift through incoming
information. It appears many security teams are lacking in this space. Afterthe initial compromise has occurred, nearly half (46%) of organizations are
typically unable to contain a threat in less than an hour. Notably, nearlya quarter (23%) of organizations that have had more than three datacompromises in the past year take at least 12 hours to contain a threat.
In the worst-case scenario, an organization will suffer an attack sodebilitating that operations will go down. All organizations surveyed havea disaster recovery plan, but most plans (51%) take at least one full day
to recover from downtime, costing the company precious time before
operations are restored. Sustained downtime can have wide-ranging
negative impacts on an organization, including wasted resources, loss ofbusiness, and damage to reputation.
Given the importance of incident response, testing the process should
be of the utmost importance. Security leaders are turning to a variety ofmethods for assessment, but many are overlooking vital practices. Less
than three in five conduct incident response exercises on a regular basis(57%), update their process based on frameworks such as NIST and MITRE
ATT&CK (59%), or measure changes in performance based on the responseto actual incidents (57%). Even organizations that have suffered the mostare neglecting key procedures — only 51% of organizations that suffered
three or more data compromises over the past 12 months regularly conduct
incident response exercises.

“

It’s imperative to quickly
identify threats during an
incident and triage what’s
critical and what’s not.
This is where endpoint
protection capabilities likeEnterprise EDR and audit &remediation can go a longway, especially when datais correlated with the rest of
your security stack.”
Justin Scarpaci
Partner Solutions Architect
VMWARE

TIME FROM INITIAL COMPROMISE TO CONTAINMENT OF A THREAT

For 54%

For 33%

For 13%

Containment takes under
an hourContainment takes one
to 12 hours

Containment takes 12 hours
or moreT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

13Legal remains a blind spot“

Incident response is a

Since breaches can damage a company’s business and create financial
and legal risks, organizations must have legal participation early on.
But the involvement of legal stakeholders remains a grey area for manyorganizations. Almost half (47%) of security leaders say their teams lackclarity about when to engage legal counsel about a potential incident.
An organization simply cannot mature without a strong incident response
plan. Key to fortifying that plan is rehearsing and practicing it, running
multiple scenarios to ensure that the team is prepared to take into account avariety of factors in case they have to put the plan into action.

47%

54%
46%

Organization lacks
right-to-audit
clauses

Teams notfully prepared topreserve evidence

52%

51%

whom to involve, when to
involve them, and how. The
uncertainty about engaging
legal counsel speaks to

RED CANARY

53%

Teams lackclarity about
when to engage
legal council

defined plan that includes

Keith McCammon
Chief Security Officer& Co-founder

Corporate Counsel, n=100

47%

of the process is a well-incident planning overall.”LEGAL ASPECTS OF CYBERSECURITY IN AN ORGANIZATION

51%

the most important aspect

a low level of maturity in

Make legal the quarterback ofincident response

Total, n=500

multi-layered process, and

43%

43%

Organization
lacks a clearly definedcommunication process

Organization lacks
readiness to notify
in the event of asecurity breachT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

14At least two in five organizations are ill-equipped to respond to the fulllegal requirements of handling an incident. These shortcomings range fromteams not being fully prepared to preserve evidence for potential litigation(46%), to issues clearly defining a communication process (43%). Many are
missing a clearly defined process to communicate with regulatory agencies(43%) and lack readiness to notify the public and/or its customers in theevent of a security breach (43%).
The complexity of data breach and cyber incident disclosures is magnified
when organizations operate across multiple jurisdictions, each withdifferent disclosure requirements and timelines. As a recent example,
a regional telecommunications company that experienced an incident
received inquiries from the FCC, the FTC, and multiple state attorneys
general. In another scenario, a hospitality industry business thatexperienced an incident received inquiries from several U.S. state andfederal agencies, as well as from data privacy regulators in Italy, the UK,
and Australia.

Challenges in acquiring data
Security teams’ inability to fully preserve evidence extends across many
forms of data. When investigating an incident, significant shares oforganizations find it difficult to acquire cloud-based services logs/data(46%), threat attribution and threat actor intelligence (43%), and technicalindicators of compromise (43%). The results highlight that investigative
expertise alone is not sufficient if organizations are unable to obtain therelevant data.

Demystifying cyber insurance
Another potentially devastating area that organizations are overlooking
is insurance. General liability insurance will typically do little to protectorganizations in the event of a cyber attack. The unprotected losses canbe disastrous, including stolen money or ransomware payouts, but also
spreading to related costs for forensic specialists, regulatory charges,
and liability.
Despite these consequences, nearly two in five (39%) organizations do
not have a cyber liability insurance policy. And the organizations mostvulnerable to attack are least protected: Over half (51%) of organizations
that had more than three data compromises in the past 12 months do notcurrently have a cyber liability insurance policy.

“

Security and risk leadersneed to understand thespecific risks that they
are looking to transfer
through cyber insurance
and focus on a policy thatwill provide that levelof coverage. That might
include provisions for digitalforensics, data recovery,business restoration, andreplacement hardware if[the] original is encrypted
and there are no decryption
keys available.”
Jason Smolanoff
Global Cyber Risk
Practice Leader
KROLLT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

15“

The role ofexternal partners inincident response

Gone are the days of
automation benefits only
being realized by technicalstaff. There are significant
efficiencies and cost savings

External security partners already play a significant role in the incident
response process, but there is room for them to do more heavy lifting. Morethan three quarters (76%) of organizations use third parties as part of theirincident response process. Sixty-seven percent (67%) use a combinationof in-house and third-party incident response, while 9% rely on third-party
incident response only. It’s clear that while organizations are leveraging
these external vendors, they can use their expertise further to help alleviate
some of their largest incident response pain points.

to be gained that will benefit
the entire organization.”
Eric Groce
Incident Response Manager
RED CANARY

Security leaders readily acknowledge that their incident response needs
strengthening in various areas. Organizations want to improve the time
taken to contain and remediate threats (55%), increase the automation of
their incident response (55%), and reduce the time needed to respond to
threats (51%). Notably, the majority (51%) of security leaders who work incorporate counsel also want to improve their breach notification readiness.
Security leaders know that increased automation can help, with nearly all ofthem planning to automate more of their incident response process over the
next year.
Despite organizations’ well-intentioned plans to automate their processes,
security teams are lacking the resources to execute on the strategies—
showing that more assistance is needed.

Nearly every organization surveyed (99%) has plans
to automate some aspect of incident response in thenext year ...

... but automation remains hindered by various
obstacles, in particular:

Automating
threat detection

68%

Lack ofin-house expertise

Automating threat
analysis and investigation74%

Lack of supporting
tech or platforms

Automating
threat containmentand remediation

72%

Excessive
time commitments47%

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

16
To address these shortcomings, security leaders are increasingly
recognizing the benefits of third-party partners that provide managed
detection and response. With security teams inundated with alerts, adding
extra people is not always the most efficient, or practical, option. Instead,a partner can have an impact across the incident response process,particularly in the areas that security leaders want to improve most. Leaders
see third-party providers as most beneficial for quicker containment andresponse to threats (55%), augmenting in-house security expertise (53%),and increased automation of processes (50%).
Leaders are looking for new partners to help leverage these benefits. Fourin five (82%) say they will likely work with a new partner to assist with theirincident response process, indicating that third parties will continue to playa growing role going forward.

“

Organizations are moreaware of threat activity,
but that’s not making theirsecurity problems go away.
Security leaders are still
looking for partners toaugment their 24x7 security
operations, with about halfof them recognizing theyneed additional capability

BENEFITS OF MDR PROVIDERS

to gather and respond to*Stats are referencing responses from security leadersinvestigative findings.”

containment
55% Quicker
and response to threats

Grant Oviatt
Director of Incident
Response Engagements

in-house
53% Augmenting
security expertise

RED CANARY

50% Increased automation of processes
48% Quicker detection of threats
robust
39% More
event logging

39%

Greaterbudgetefficiency

As security leaders look for a new partner, two factors are particularly
crucial. For 86%, it is important that a partner can handle multiple aspectsof threat management, specifically 24/7 response, containment, andremediation of threats by trained experts. For 87%, the most importantfactor is that the partner can provide automated tools to reduce the meantime to respond to threats.

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

17Conclusion
Security teams around the globe have responded brilliantly to theunprecedented challenges they’ve faced over the past year, but theimmense pressure that teams are under doesn’t show signs of letting
up anytime soon. With one dangerous attack following the other, thetime to act is now. There’s ample opportunity to improve on processes
that may have been put in place in a hurry, or those that may have
simply become outdated.
It’s as good a time as any for security teams to reevaluate their detection
and response capabilities, adopt new best practices, shore up incident
response plans, and bring in trusted partners to help fill in any gaps inresources or expertise. Based on the findings of this research, here areseveral actionionable steps organizations can take today:

Build a secure foundation
No organization is immune to cyber attack. Ensure the foundational security
controls are in place to help you catch threat activity before it becomes asignificant problem for your organization. Strong identity protection like
multi-factor authentication remains vital in slowing adversaries, as it better
secures the weakest link in any security organization’s posture: humans.

Test the process, close the gaps
Given the importance of incident response, testing the process should
be of the utmost importance, especially given the significant numberof respondents reportedly lacking adequate tools, having insufficientexpertise on staff, and spending too much time investigating low-level
alerts. Security leaders are turning to a variety of methods for assessment,
but many are overlooking vital practices. Conduct incident response
exercises on a regular basis, update your incident response process basedon frameworks like NIST, and measure any changes in performance basedon the response to actual incidents.

T H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

18“Compliance and models

Adopt security best practices
Organizations not following best practices in their security operations
aren’t setting themselves up for a high likelihood of success. While
introducing best practices and formal strategies won’t automaticallymake an organization more secure, it will provide a clear structure andenable easier measurement of security processes’ effectiveness.

don’t inherently makeyou safer. But they doprovide you with structure,
make it easier to measure
and communicate what
your program is doing,
and they also make it harderto ‘forget’ to do things
that you decide areimportant, like performing
compliance audits ofpartners or regularly drilling

Build a bridge to legal counsel
Legal implications of being breached remain uncertain to manyorganizations, with almost half the survey respondents reporting a lack ofclarity on when to engage counsel about a potential breach. By fosteringcollaboration between infosec and legal, organizations can eliminate thisuncertainty and create an easy pathway for staff to follow to get quickanswers when an attack is underway and time is of the essence.

Partner with third-party providers
Security leaders are increasingly recognizing the benefits of third-party
partners that provide managed detection and response. With security teams
inundated with alerts, adding extra people is not always the most efficient,or practical, option. Bringing on a third-party provider as a partner can havean impact across the incident response process, particularly in the areasthat security leaders care about the most: improving time to containmentand response to threats, augmenting in-house security expertise, andincreasing automation.

your incident response
team/process.”
Keith McCammon
Chief Security Officer& Co-founder
RED CANARYT H E S TAT E O F I N C I D E N T R E S P O N S E 2 0 2 1

19

About the data
The Kroll, Red Canary, and VMware Carbon Black State of Incident
Response Survey was conducted by Wakefield Research among 500
security leader respondents from companies with personnel/staff of 700 or
more and revenue of more than $500 million, between November 16 andDecember 2, 2020.
The security leader audience is comprised of two sub-groups:•

IT/Information Security (n=400): respondents with the titles of CIO,
CISO, CSO, CTO, and Director of Security, Information Security or IT•

Corporate Counsel (n=100): respondents with the titles of Chief Legal
Officer, General Counsel, Chief Compliance Officer, Chief Privacy
Officer, EVP/VP of Legal Affairs or Legal/Compliance/Privacy Manager

The overall margin of error for this study is +/-4.4 percentage points at
the 95% confidence level. Base sizes under 100 are considered small andassociated findings are directional.

Kroll is the world’s premier provider of services and digital products related to governance, risk andtransparency. We work with clients across diverse sectors in the areas of valuation, expert services,
investigations, cyber security, corporate finance, restructuring, legal and business solutions, data
analytics and regulatory compliance. Our firm has nearly 5,000 professionals in 30 countries andterritories around the world. For more information, visit www.kroll.com.

Red Canary is the leading security ally enabling every organization to make its greatest impact without fearof cyber-attack. The company provides outcome-focused solutions for security operations teams, who rely
on Red Canary to analyze and respond to endpoint telemetry, manage alerts across the network, and provide
cloud environment runtime threat detection. With Red Canary, security teams can make a measurable
improvement to security operations within minutes. To learn more, visit redcanary.com.

VMware software powers the world’s complex digital infrastructure. The company’s cloud, app modernization,
networking, security, and digital workspace offerings help customers deliver any application on any cloudacross any device. Headquartered in Palo Alto, California, VMware is committed to being a force for good,from its breakthrough technology innovations to its global impact. For more information,please visit www.vmware.com/company.
VMware and Carbon Black are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in the
United States and other jurisdictions.