10
Sustainability Statement

Sustainability
Statement

A PDF optimized for printing
is available for download atwww.f-secure.com/en/investors

Annual Report 2023

11

Sustainability Statement

Towards sustainable security experiences

Sustainability Statement
General information
Environmental information
Social information

Our responsibility as a cyber security service provider
is to ensure that that we protect consumers in all
those digital moments in which consumers feel mostvulnerable. Moments in which scams and fraud arecommonplace such as messaging, browsing, shopping,banking and payments, social media, and more. Our strategy is to securethese digital moments through a simple, elegant, and non-intrusive consumer
experience: combining holistic security in the most critical digital moments withan experience that makes it extremely easy for users to stay safe and feel secure.
Service Provider partners continue to provide us reach and wider adoption,
which is important as it’s been estimated that more than $1 trillion was stolen
from 25% of the world’s population last year. With the acquisition of Lookout Lifein 2023, we gained a number of new Tier 1 partners, some of the most prominent
Service Providers in the world. Through these partnerships hundreds of millions
of consumers now have the opportunity to be protected by F-Secure and enjoy
the benefits.
Similar to 2022, we have continued to develop F-Secure into the best
environment for people to develop and apply their skills, competencies andexperience for a great purpose – making every digital moment more secure,for everyone. We’ve also dedicated considerable time and effort to ensuring
the smooth ­integration of people, competences, market knowledge andtechnologies of Lookout Life into the core of F-Secure strategy, processes andmode of operation. Today, our employees represent nearly 50 nationalities, andwe intend to continue building a team of people from diverse backgrounds,
ensuring that everyone can join our community and be who they are.”
Timo Laaksonen, President and CEO

Since the launch of our ESG initiatives in 2022, we’ve
identified that our most material contribution to society
and economic progress is to secure people’s digital
moments, and to fight against cybercriminals and identity
theft. With the number of scams and cyberthreats on
the rise this year, we have stepped up our efforts to protect people through our
holistic product portfolio while providing free tools and education. To further
support this mission, we made a significant investment by acquiring US-based
Lookout Life, which complements our product portfolio, and strengthens our
skills and competences in a mobile-centric world. Through these actions we’reempowering consumers to navigate the digital landscape securely, while helping
to raise awareness and knowledge of the threats.

Own workforce
End-customers
Cyber security
ESG Governance information

In 2023, we continued to invest in ESG-related expertise and initiatives, andincreased transparency across our operations. In an industry characterized bycompetition for the best talent and relatively male-dominance, we embarked
on a journey to reshape our talent acquisition processes and practices, actively
striving to hire and attract a more diverse workforce, including participation in the
Women in Tech and Pride initiatives. Diversity, Equity and Inclusion remain corevalues at F-Secure and we’re pleased to see zero incidents of discrimination in
2023. We also recognize that our industry is demanding for our employees, andwe remain committed to the health and wellbeing of our employees.
We value the opinions of our employees. That’s why, starting from the first yearof the company, we introduced a program where one of the Board members is
chosen from among the employees – or as we call them, Fellows. This has helped
the Board of Directors to better understand how our decisions impact our teams,
resulting in better decision-making.
Furthermore, we completed our first carbon emission analysis, which
demonstrates that as a software company, our ecological footprint is relatively
small. Nevertheless, we respect the planet and are in the process of defining
science-based greenhouse gas emission reduction target aligned with the
Science Based Targets initiative (SBTi).”
Pertti Ervi, Chair of the Board of Directors

Annual Report 2023

12

Sustainability Statement

General information

Sustainability Statement
General information

Establishing F-Securesustainability foundations
Following the demerger from WithSecure in June 2022,
F-Secure has been renewing its sustainability strategy,
policies and guidelines. In 2023, we continued ourdouble-materiality assessment started in 2022 andhave involved key stakeholders, namely consumers,

Service Provider partners, our employees, andLeadership Team into the process.
The assessment confirmed that the most material
areas for F-Secure and its stakeholders are protecting
people and society, our employees, cyber security, andgeneral compliance. The sustainability strategy work
culminated in the launch of our ESG Commitments as

highlighted below. Additionally, recent EU legislative
initiatives such as the Corporate Sustainability
Reporting Directive (CSRD) and European Sustainability
Reporting Standards (ESRS) have been evaluated andare already influencing the structure of F-Secure’s 2023
sustainability report and the reported KPIs.

Environmental information
Social information
Own workforce
End-customers
Cyber security
ESG Governance information

Protecting digital moments

Responsible business

Fellow experience

Annual Report 2023

13

Sustainability Statement

Sustainability Statement

Protecting digital moments

Responsible business

Fellow experience

Today, almost everything we do as consumers is digital:
we shop, exercise, work, socialize, relax and unwind,
all while being connected. Our insights show that
consumers now spend an average of eight hours a day
online, which is a third of their lives. This is more timethan most people spend sleeping.

Trust placed in F-Secure is earned only when actions
match the words. Since the founding of F-Secure we’veemphasized strong business ethics covering both how
we work with consumers and Service Provider partners,
as well as in how we handle their data. F-Secure Cyber
Security Policies include processes to identify, mitigate
and prepare for a potential business disruption, and
our Code of Conduct sets a clear framework guiding
our daily decision-making. At F-Secure, each employee
plays a critical role in earning, building, and maintaining
the trust placed in us.

Our employees or “Fellows” are the key to our success.
Focus on talent development and wellbeing continued
after the demerger and acquisition of Lookout Life at
all levels of the organization. Our activities centeredaround both retaining our current Fellows and creating
a positive employer brand image to attract new talent.

Although digital moments are crucial in our lives, twothirds of consumers find cyber security too complex,
and over half are unsure if their devices are protected.
We’re also seeing an increase in various types of online
scams, and a staggering 1.02 trillion US dollars waslost to scams between August 2022 and August 20231).
Therefore, it’s no surprise that 64% of consumers thinkcyber risks are going to increase in 2024.2)
This reinforces our belief that F-Secure’s mission to
make every digital moment more secure for everyone
and deliver brilliantly simple security experiences
will be in higher demand than ever before. To fulfil
our mission, we will maintain our commitment toproviding thorough and holistic protection against
scams in digital moments. Additionally, we will strive to
educate consumers and raise awareness of the threat
landscape.
Together with our Service Provider partners across theglobe, we’re protecting consumers and increasing theirconfidence and trust in digital services, and thereby
in society as a whole. This represents our tangible
contribution to social and economic progress.
1)
2)

Global Anti-Scam Alliance survey 2023
F-Secure Living Secure survey 2023

When it comes to the environment, F-Secure is a
low carbon emission, cloud-based consumer cybersecurity software company. While our greenhouseemissions are low, we respect the environment andare committed to doing the right thing for the planet as
described in the section related to environment.
In 2023, F-Secure made its first submissions to rating
agencies such as Ecovadis and Carbon Disclosure
Project (CDP). In 2024, we will continue to increase
visibility to F-Secure ESG policies, guidelines, andkey performance indicators (KPIs) both directly andthrough external rating agencies.

We also believe that true long-term success is built on
diverse backgrounds, knowledge and perspectives.
Therefore, we continue to ensure that F-Secure is acompany that offers interesting and inclusive career
paths to everyone. To further drive Diversity, Equity,and Inclusion (DEI) related activities within F-Secure a
dedicated DEI Committee has been established.

General information
Environmental information
Social information
Own workforce
End-customers
Cyber security
ESG Governance information

Additionally, the wellbeing of our Fellows is critical forthe success of F-Secure. We will continue to develop
and implement an active wellbeing strategy, measuring
progress while also considering the recent acquisitionof Lookout Life. Similar to our Diversity, Equity, andInclusion (DEI) efforts, we have established an F-Secure
Health & Wellbeing Committee.

We’ve also established F-Secure ESG Council tooversee ESG strategy creation and execution acrossthe company as well as reporting progress to the Audit
Committee. See sections on Security and privacy inour daily operations, ESG governance information andCorporate Governance for more details.

Annual Report 2023

14

Sustainability Statement

Environmental information

Sustainability Statement
General information
Environmental information
F-Secure carbon emissions 2023

8,525 tCO2 = ~ 315 ×
While we are a low
carbon emission,
cloud-based cyber security
software company, we’recommitted to managing our environmental
footprint and delivering sustainable growth.”

Average sized
Finnish family’semissionsSocial information
Own workforce
End-customers
Cyber security
ESG Governance information

Antero Norkio, Senior Vice President

Sustainable security experiences
At F-Secure, we are committed to environmental
responsibility in all aspects of our operations. At ourcore, we’re a low carbon emission, cloud-based cybersecurity software-as-a-service company with a small
environmental impact.
We conducted our first emissions inventory calculation
based on the Greenhouse Gas Protocol (GHG) for
financial year 2022 in April and have now conducted
the same calculation for financial year 2023. The results
are a testament to our small environmental footprint,

with our annual emissions for financial year 2023 being
the equivalent of 315 Finnish families’ emissions1)
As we want to be at the forefront of increasing climatetransparency, we will continue to report on our Scope
1–32) emissions on an annual basis at a minimum.
2023 was marked by the acquisition of Lookout Life,and as a result, our 2023 emissions aren’t directlycomparable to 2022. Lookout Life’s operations closely
resemble ours in terms of low environmental impact
and being a cloud-based software company, andthe emissions increase of the consolidated entity is

in line with its share of revenue within F-Secure. To
make future comparisons more viable, we’ve included
pro-forma emissions of Lookout Life for the whole year
2023, even though it was integrated into our operations
starting from June 1, 2023.
1)

 -Secure management estimate based on average Finnish
Fperson and household emissions as of 2023

2)

 HG protocol defines Scope 1 as direct emissions from ownedGor controlled sources, Scope 2 as indirect emissions from thegeneration of purchased energy consumed by the company and
Scope 3 all other indirect emissions that occur in a company’svalue chain (upstream or downstream).

Annual Report 2023

15

Sustainability Statement

Sustainability Statement

2023 laid the foundation for futureenvironmental commitments
In 2023, as part of our sustainability strategy process,we’ve discussed with and gathered feedback from ourpartners regarding their expectations in environmental
stewardship.
Based on these discussions and our sustainability
strategy, we’ve started planning to align with the
Science Based Targets initiative (SBTi) and driving

Total emissions by scope (tCO2)

General information
towards the +1.5C climate change target during 2024.
We have already decided upon and/or implemented
several initiatives to reduce our emissions, such aschanging our car benefit to allow only electric andhybrid vehicles, implementing a green travel policy,
and ensuring proper recycling of all office and e-waste.
We’re excited to continue on this path and look forward
to working together with all of our partners and stakeholders to further lower our already low environmental
impact.

Based on our double materiality analysis, we concluded
that Climate was a material topic while Water andMarine Resources, Biodiversity and Ecosystems,
Resource use and Circular Economy, and Pollution
were not considered material for our operations inaccordance with the EFRAG standards.

Scope 3 emissions breakdown (%)

Emissions intensity(tCO2/m€ revenue)

Environmental information
Social information
Own workforce
End-customers
Cyber security
ESG Governance information

8,525
Other 2%
4,268

Business travel

2022

14%

58

84% 
Purchased goods
and services

382023 1)

2022

2023

2022

● Scope 1

35

26● Scope 2

187

178

● Scope 3

8,303

4,064

1)

2023 1) ro-forma emissions for 2023. Not comparable to 2022 due toP
Lookout Life acquisition and aligning our emissions model with
SBTi criteria and recommendations.

Annual Report 2023

16

Sustainability Statement

Social information
Fellow experience

Sustainability Statement
General information
Environmental information

F-Secure Social Information statement is aligned with our ESG Commitments
and divided into three categories:

Social information• Own workforce under “Fellow experience”• End-customers under “Protecting digital moments”• Cyber security under “Security and privacy in our daily operations”
Our commitment tosustainability is not justabout protecting digital
moments; it’s about nurturing
the wellbeing and potential of our greatest asset –our people. Together, we are building a sustainable
future for people and society, and also fostering
a workplace culture that thrives on purpose,diversity, openness and shared responsibility.”
Kitta Virtavuo, Chief People Officer

Inclusive and diverse workforce
At F-Secure, our people are our greatest asset, andhiring the right individuals is one of our competitive
advantages. We strive to create an inclusive work
environment where everyone can be themselves,
thrive and grow as professionals. We have a strong
DEI ((Diversity, Equity, and Inclusion) agenda and wehave established an internal DEI Committee to act asa frontline to implement DEI into our daily processes
and operations. Our DEI agenda included among otherthings updating our recruitment process to further
attract a more diverse workforce. In addition, F-Secure
was supporting the annual Helsinki Pride 2023 as apartner. This sponsorship not only raised awarenessinternally but also solidified DEI as a core topic for us. In
2024, we will further develop metrics to measure theeffectiveness of our DEI programs and initiatives.

Own workforce
End-customers
Cyber security

employee information. This will also be reflected in ourannual sustainability statement starting in 2024.

Moreover, it is important for us that all our employees
have equal access to opportunities and receive thesame treatment. We firmly believe that a diverse
workforce is a key driver for success, which we actively
take into account in a relatively male-dominanceindustry. F-Secure is a genuinely diverse company with
employees representing 47 different nationalities. By theend of 2023, the representation of males and females
among personnel was 70% and 30% respectively.
Among the leadership team, the representation was
75% and 25% respectively, and among the Board of
Directors, it was 67% and 33% respectively. We arealso pleased to report zero discrimination incidents at
F-Secure during 2023. To further our DEI agenda, we will
include a third gender option in our internal systems for

ESG Governance information

F-Secure promotes inclusion and diversity also byelecting one of our employees as a full Board member
with related rights and responsibilities for one year. In
most companies, a personnel representative is not afull member of the Board, but a specialist with a right toparticipate and speak, sometimes with limited scope,
and without a right to vote. At F-Secure, we wanted an
employee to be a full Board member to demonstrate
the importance of our Fellows, which is how we refer toour employees. This practice has been much appreciated and valued by the employees and the Board.

Gender distribution
Board of Directors

47

nationalities

Female33%

Leadership Team

Female
67%

Male

25%

Employees

Female
75%

Male

30%
70%

Male

Annual Report 2023

17

Sustainability Statement

Sustainability Statement
General information
Culture Journey, we’ve been involving all levels of staff toconduct data-driven understanding of the key driversof culture in the organization, known as culture due
diligence. The next step is to finalize the desired culture
definition at the beginning of 2024.

However, as an employee of F-Secure, the chose
Fellow is expected not to participate in issues on, e.g.,
leadership appointment (or dismissal), remuneration orother terms of employment or service, industrial action
etc. that the Board of Directors may handle from time totime.
“F-Secure has been recognized in the Nordic Business
Diversity Index and ranked third among the Nasdaq
Helsinki Mid-Cap sized companies1). In addition,
we create a more resilient workforce by having an
inclusive culture that supports psychological safety
and wellbeing. For example, we acknowledge we
operate in a highly demanding industry and have anagreement with Auntie, a low-threshold mental healthservice that provides mental health support completely
anonymously to our employees.
We believe that a great company culture makes fora stronger company. In mid-2023 we launched our
culture design process called Culture Journey. The aimof our Culture Journey is to define what kind of company
culture supports the strategy of F-Secure and establish
the cornerstones that crystallize the desired cultureof the company, also together with the Fellows joining
through the Lookout Life acquisition. As part of the1)

Diversity of the Boards of Directors and Executive Management
teams of 631 companies analyzed by Impaktly.

An additional focus area was to enhance the development and learning opportunities for our employees. In
2023, we have launched several programs, including
Leadership Academy, DEI trainings and implemented
a new Learning Management System. These programs
have increased awareness and knowledge sharing
around topics such as DEI, internal policies andprocesses, leadership, and communication skills.

Discrimination incidents and fines

Environmental information
Social information

2023 status
Total number of incidents of
discrimination reported and resulting in
financial sanctions during the year

0

Status of incident reviews

No incidents

Total amount of fines and damages
for violations of equal opportunity for
employees0€

Own workforce
End-customers
Cyber security
ESG Governance information

Strengthening collaboration
In 2023 F-Secure was again ranked high in Universum’s
ranking of Finland’s most attractive employers. This
year F-Secure was #5 among IT students and #14 in
the Professional’s category. To strengthen collaboration
with students we participate in initiatives such as Cyber
Citizen by Aalto University and course-related project
cooperation. We also facilitate student trainee andmentoring opportunities through our collaboration with
Aalto international talent program.
To support a more diverse workforce we have sponsored Women in Tech and co-hosted events. We aim to
broaden our agenda by starting a collaboration with the
UN Women program. We have also increased diversity
in our own Leadership Team through the launch of the
Extended Leadership Team involving Fellows acrossfunctions that also creates new types of career paths
and opportunities.

Annual Report 2023

18

Sustainability Statement

Sustainability Statement

Encourage open discussion
and adapting with change
We encourage and facilitate open dialog within
F-Secure and monitor the employee Net Promoter
Score (eNPS) twice per year through a Fellow survey,
which is conducted to measure F-Secure’s culture
and the engagement of our Fellows. The results werereviewed by the Leadership team and discussed within
respective functions as well as in company-wide town
halls. Company level improvements have been agreed
by the Leadership team as well as at the team level,
where we have facilitated each team to contributewith their own improvement initiatives and plans. A
summary of the survey and key action points were
presented to the Board of Directors.
2023 was a year of change that affected everyone
at F-Secure due to the acquisition of Lookout Life in
Q2 and the change negotiations that concerned theentire workforce in Q4. With the Lookout life acquisition
F-Secure grew by 68 employees, and the focus was on
integrating the new employees into F-Secure processes,
including HR processes such as annual goal setting
and performance reviews.

General information
The Q4/23 change negotiations were initiated as partof measures to restructure F-Secure’s global operating
model and personnel to align with our strategic
priorities and financial targets. We recognize that thishas been a difficult time for our employees. We havecommunicated as actively and openly as possible andhave offered support to employees who are leaving. As
a result of the change negotiations and other measures,
56 employments in F-Secure were terminated, of which
39 in Finland. In addition, 10 roles of which 8 in Finland,ceased e.g. through resignations. In the spirit of transparency and open communication with our Fellows, we
proceeded with our Fellow survey during the change
negotiations. The impact can be seen in the eNPS
results, which declined from 53 at end of April to 2 at theend of 2023 due to understandable uncertainty about
the future.1) In 2024 we are committed to restoring theeNPS to its former level.

Employee Net Promoter
Score

45
38

Environmental information
Social information
Own workforce

53

End-customers

38

Cyber security
2 2)

ESG Governance information

Q2 Q3 Q4 H1 H22022 2022 2022 2023 20232)

 2/2023 not directly comparableH
as measured during the change
negotiation process

As part of our preparation for the CSRD legislation we
conducted a double materiality assessment which
identified “Own workforce” as one of the key areas forour business. The assessment also concluded that“Workers in value chain” and “Affected communities” arenot considered material to F-Secure.
NPS can range between –100 to 100, and above 0 is acceptable,>20 is favorable and above 50 is excellent1) Annual Report 2023

19

Sustainability Statement

Sustainability Statement
General information
Social information

Environmental information

Protecting digital moments
Complexity remains one of the worst enemies of cybersecurity and a recent survey conducted by F-Secure
showed that 66% of consumers find cyber security
complex. 1) This is why F-Secure has embarked on a
mission to deliver brilliantly simple security experiences
and realize its vision to become the #1 security
experience company.
We execute on our vision and aim to become theconsumer’s trusted companion through several means:
1 Holistic protection across consumers’ digital
moments that provides a sense of security
2 Contextual and personalized experience that makes
security visible during relevant digital moments andrelevant to consumer needs

Social information
Own workforce
End-customers
Scams are becoming
more commonplaceand difficult torecognize, and wecontinue to see consumers
struggling to protect themselves and theirdigital moments. We’re extremely pleased withthe progress made 2023 to provide engaging
and easy-to-use holistic scam protection to
become consumers’ trusted companion online.”

Contrary to the
popular belief,cybercriminals do nothave to be technologicalmasterminds. Today, cyberthreats are both more personal and prevalent as
tools for conducting cyber crime are available
to anyone. At F-Secure, we dig deep into thesethreats to understand threat actor capabilities,
tools and technologies, to develop holistic
countermeasures against them.”

TL Viswanathan,Chief Product Business Officer

Cyber security
ESG Governance information

Laura Kankaala, Threat Intelligence Lead

3 Helping consumers be aware and empowered to staysafe online, and providing advice and support when
consumers need it

A need for simpler cyber security
We asked the people whether they agreed withthe statement “I find cyber security too complex”
42%

23%

24%

11%

Strongly Somewhat Somewhat Strongly
disagree disagree
agree
agree

All-in-one security and privacy app
A significant milestone in the realization of our vision
was the release of F-Secure Total in Q1/2023, which
includes all the security, privacy and identity protection
features in one single app across operating systems.
We constantly monitor the success of our journey using
the Net Promoter Score (NPS) and were pleased to seethat the NPS for Total was 49 in 2023, an improvementfrom 42 in 2021 and 46 in 2022.
We expect the NPS to continue to increase in 2024
as we launch new versions of Total that enhance thecustomer experience and introduce new protection
capabilities particularly against scams, also leveraging

expertise and product assets obtained from the Lookout
Life acquisition.

Simplification and wider adoption
via Embedded Security
We continued to focus our efforts on simplifying thecustomer experience and driving consumer adoptionof security and privacy solutions. The rollout of theEmbedded Security portfolio capabilities that integratewith the home WiFi router similarly progressed together
with our Communication Service Provider (CSP)
and router manufacturer partners (F-Secure Sense).
1)

F-Secure Living Secure survey 2023

Annual Report 2023

20

Sustainability Statement

Sustainability Statement
General information
Sense automatically protects all family members andconnected devices without the need for any activity
on the consumer’s part creating a frictionless, secure
broadband customer experience.
During the year F-Secure expanded its Embedded
Security offering and launched a range of SDK andcloud API-based protection capabilities, also leveraging
the assets obtained through the Lookout Life acquisition. 1)
These capabilities make it possible to easily reach
Service Provider’s existing end-customers as there
is no need to install a separate security app. Rather,
the Service Provider embeds the SDKs provided by
F-Secure in their existing application or leverages
similar capabilities provided via F-Secure cloud. For
example, in October 2023, TNG Digital embedded
F-Secure SDK capabilities into the Touch ’n Go eWallet
app, making security accessible to over 21 million of its
existing customers.

Protecting consumers with our
Service Provider ecosystem
Service Providers like CSPs play a major role inprotecting consumers from online threats. Many of ourpartners see security as an integral part of their offeringand brand promise, and are committed to helping
consumers feel safe, secure and confident online.
To help our partners deliver security to theirend-customers, we have spent more than a decadebuilding scalable expert and cloud-based services
that culminate in our Security Business Platform.
Through this platform, our products and services can bedelivered to consumers as an integrated offering thatpartners can easily sell and deliver.

Our partners value our offering, day-to-day support andthe business outcomes we deliver. We’re pleased that
our Partner Business Net Promoter Score remainedon an excellent level being 56. In addition, we signed 15
completely new Service Provider contracts in 2023 toincrease consumer security product adoption acrossgeographies. Following the Lookout Life acquisition,
F-Secure is also better positioned to serve the needsof large Tier 1 Service Providers, for example, AT&T,
T-Mobile/Sprint and DoCoMo.

Research and innovation toprotect against scams
Various types of scams (as shown in figure below2))
have now become a trillion-dollar business, alreadyaffecting more than 1 out of 4 people worldwide.
These frauds can resemble traditional tech support
scams where criminals pose as bank or government
officials who insist that victims transfer large sums ofmoney to various accounts for “safe” keeping. Or faketext messages received especially during the holiday
season from a delivery company asking for more
information that could lead to identity theft.

Types of scams faced by consumers
SMS scams

12%

Call scams

11%

Credit card scam

8%

Social media scam

Environmental information

Additionally, generative AI tools are helping scammers
create more convincing narratives and fake advertisements. Cybercriminals are also likely to create more
fake shopping websites and combine them withmalvertising to trick victims into handing over their
credit card details. With the help of generative AI toinstantly aid the construction of entire ecommerce
experiences and crafting professional marketingmessages, these fraud sites will become even moredifficult for consumers to detect and avoid.

ESG Governance information

Social information
Own workforce
End-customers
Cyber security

To combat these threats, we have added Trusted
Shopping capability to F-Secure Total that lets
consumers know the trustworthiness of online storesand check if the store is safe to buy from. We have also
made the same available as a new free tool (Online
Shopping Checker) among our other free tools. To
further protect consumers from scams, phishing andother threats, and as part of our evolution as an independent company after the demerger, we have beenworking on improving our architecture and systems,
and developing our own Protection APIs dedicated toconsumer-focused use cases.

8%

Identity theft scamBanking scamAlso, if consumers are going to lose money to a scam,chances are that the scam will start on social media.
One big reason is that these platforms are filled withadvertisements for fake products with fake discounts.
Our data shows that 44% of all social media fraud loss
reports come from people who tried to buy something
being advertised on social media. The most common
shopping scams ended with the purchased goods
never arriving or arriving replaced with junk.

5%
3%

1)

 oftware Development Kit (SDK), Application Programming
S
Interface (API)2)

 -Secure global consumer market survey, Jun 2023, N=4,400 andF
Global Anti-Scam Association survey 2023

Annual Report 2023

21

Sustainability Statement

Sustainability Statement
General information
Our deployed products are undergoing a transition
from the previous generation of APIs that focused on
end-point protection, primarily Windows malware. Last
year we reported that our customers used our previous
generation APIs approximately 900 million times everyday. On a fully comparable basis, that number is now
approximately 750 million, as we transition to our new
APIs and can also optimize the number of queries.
Using our new APIs, our scam protection technology is
now being used approximately 20 million times per day,

1. Mapping the scam landscape.
Cybercriminals are constantly
inventing new scams. The
starting point of our entire
research process is building
capabilities to holisticallyunderstand and respond to thesethreats.

2. Defense in depth. When
responding to threats, we
combine multiple technologies
into comprehensive andholistic protection including but
not limited to malware analysis,
URL categorization andreputation, privacy VPN, data
breach monitoring services,router security, and more.

Scma number that we expect to grow significantly in 2024
as we transition to new APIs.
In addition, now that we have completed theTransitional Services Agreements (TSAs) with
WithSecure, we are redirecting our cyber security
research efforts to create additional capabilities that
protect consumers against various types of scams.
This research and protection strategy that continues toguide us also over the long term includes four key parts:

Environmental information
Social information
Own workforce
End-customers
Cyber security
ESG Governance information

4. Contextual holistic protection. By combining
all of these, we can begin to build contextual andholistic protection. When we understand theconsumer’s personalized threat profile, we canprovide ­personalized defense. In addition to thetechnological defense in depth it is also about ourability to advise consumers effectively offering
personalized advice, which might be very different
for a 20-year-old versus a 70-year-old person, andvary from country to country and more.

3. Personalized threat profile. As part of defending
consumers, we also see a lot of data on how
consumers behave, while respecting their right toprivacy. This includes for example what threats wedefend them from, where, when, and how. This richdata stream will allow us to build a personalized
threat profile.
Annual Report 2023

22

Sustainability Statement

Sustainability Statement
General information

Continued awareness creation
regarding cyber threats
Increasing consumer awareness on cyber threats andproviding tips, best practices and actionable information about the evolving threat landscape remained highon F-Secure agenda.
Through various campaigns and our content
creation strategy, we have been able to reach 10
million consumers across the globe. This includes
the publication of “F-Alert”, a monthly newsletter that
informs consumers about what’s happening in cybersecurity. Even more importantly, it tells consumers why
threats are happening and offers advice from F-Secure
experts to help secure consumer’s digital moments.
Additionally, more than 40 articles, eBooks and white
papers have been published on topics such as AI, how
AI scams work, what is spoofing, how to avoid fakewebsites and more.
Note that the above does not include awarenesscreation activities and consumers reached through our
Service Provider partners, which can be estimated tobe significant.

Environmental information~800

million protection
events daily

F-Secure Total NPS

42

2021

46

49

2022

2023

Reached10

million consumers
increasing cybercrime awarenessSocial information
Own workforce
End-customers
Cyber security
ESG Governance information

F-Secure Partner
Business NPS
57

56

2022

2023

Annual Report 2023

23

Sustainability Statement

Sustainability Statement
General information
Social information

Environmental information

Security and privacy in our daily operations

Social information
Own workforce

Our approach to cyber security

It is impossible tobuild sustainability
without trust. We arecommitted to protecting
this trust by developing and operating our
products securely.”
Johannes Kossila,
Chief Information Security Officer

F-Secure is in the business of trust. Through our
products we are present in our customers’ digital
moments and have developed a unique understandingof the consequences of personal data breaches toindividual lives. Data breaches often have financial
consequences and at worst they can have a significant
impact on the mental and physical wellbeing of thevictim. Therefore, when we offer our products to ourcustomers, we ask them to put their trust in us tosecure their digital moments. F-Secure is committed
to maintaining this trust by building cyber security
and privacy into our products and operations, and bycomplying with the related applicable legislation in the
countries where we operate.

End-customers

F-Secure’s approach to cyber security focuses on
managing of information security, privacy, and software
security across our products and the supporting
operational processes. Our Cyber Security Policy andthe related procedures define the applicable security
practices in accordance with F-Secure’s strategy.
The Cyber Security Policy is reviewed annually andapproved by our CEO.
To ensure the fulfilment of our cyber security objectives,
F-Secure Chief Information Security Officer together
with the Security Office leads the governance andimplementation of the cyber security practices
across all business functions. Security metrics andprogress of security initiatives are regularly reported
to the F-Secure Leadership Team. In addition, theSecurity Steering group consisting of the CEO, GeneralCounsel, CTO, CFO, and Corporate Development
directs strategic security work and reviews security
performance on quarterly basis.
Our cyber security initiatives reflect the current threat
landscape. We identify and mitigate relevant cybersecurity risks to prevent and prepare for potential
business disruptions. Proactive security incident andbusiness continuity management processes supported
by regular drills are critical to maintaining the resilienceof our products and business services.
F-Secure products are developed and operated inaccordance with our comprehensive secure software

Cyber security
ESG Governance information

development lifecycle. Our ambition is to develop
secure software and identify potential security
threats early in the development process. An efficientvulnerability management process supported by our
bug bounty program is the foundation for maintaining
the security of our products after they are released to
production.
Skilled and security-aware employees are the key to ourcyber security governance. We provide our employeeswith the support, tools, and instructions to performtheir work securely and promote security awareness intheir personal lives and with their families. We are also
active in various security communities and forums topromote general security awareness and the development of industry practices. For example, F-Secure is along-standing member of The European Cyber Security
Organization (ECSO).
Annual Report 2023

24

Sustainability Statement

Sustainability Statement

We continuously assess the effectiveness of our cybersecurity governance and adhere to industry standards
to ensure high-quality security practices. Our cybersecurity management processes are compliant
with the ISO27001 standard for information security
management systems and we conduct regular internal
audits to confirm that our products and businessprocesses follow the appropriate cyber security
practices.
After the demerger from WithSecure in 2022, F-Securehas been renewing its cyber security strategy, policies
and guidelines and establishing new cyber security
capabilities. During 2023, we conducted a complete
review of our cyber security policies and updated themto reflect the new F-Secure organization and ways
of working. We also started a compliance project toachieve ISO27001 certification for our cyber security
management system covering the entire organization.
In accordance with our updated security policies, we
renewed our annual cyber security awareness training
and rolled it out to all employees. In addition, 84% of ouremployees are participating in our continuous phishing
simulation training. With these security trainings, we
saw clear improvements in our security culture during
the year.
In 2023, we launched our Security Operations Centerfor centralized coordination and response to security
incidents. Throughout the year, we faced only two major
security incidents which were both responded to andmitigated in a timely manner. No customer data wasaffected by these or other security incidents.
Finally, we continued to improve the coverage of
our automated vulnerability management toolson our products and supporting infrastructure. We
improved our patching cadence and continued towork with independent security researchers to identify

vulnerabilities and bugs in our products which were
not identified by our tools. In 2023, we paid total of 7,200
euros through our bug bounty program to 14 reported
cases, of which three were classified as high severity
and the rest as low severity.

Ensuring privacy while handlingour customers’ personal data
F-Secure continuously assesses the impact of privacy
regulations on our operations and identifies the key
regulatory requirements arising from them. We willcontinue to maintain an up-to-date understandingof regulatory developments and changes in ourbusiness and to update our internal privacy policies
and processes accordingly. F-Secure conducts
regular privacy impact assessments for all significant
personal data processing activities. The outcomes ofprivacy impact assessments are considered in thedata processing implementation, thereby ensuring
implementation of the principle of Privacy by Design.
In 2023, F-Secure participated in a General Data
Protection Regulation (GDPR) compliance assessment
by an external assessor. According to the assessment,
the overall level of data protection compliance at
F-Secure is high. In particular, our strong privacy culture,established processes and documentation, and thepractices related to our products received positive
feedback. The identified growth areas related to a lackof overview of privacy processes after the demerger in
2022, and steps have been taken to revive and clarify
legacy processes. In addition, a new onboarding courseon the F-Secure Learning Academy introducing privacy
topics was introduced and additional live training
events were organized. Finally, the privacy team is inclose contact with the business and provides support,such as advising on new features.

Key cyber security and privacy
initiatives for 2024
We will continue to expand the monitoring scope of our
Security Operations Center and focus on introducing
new tools to further support our secure softwaredevelopment lifecycle for products. In addition, we
will conduct a review of our company-wide business
continuity plans to better address system components
acquired through the Lookout Life acquisition. Finally,
our ambition is to complete our security complianceproject and achieve ISO27001 certification during 2024.

General information
Environmental information
Social information
Own workforce
End-customers
Cyber security
ESG Governance information

F-Secure’s privacy program will focus on three mainareas in 2024. Firstly, the product privacy policies will
be updated to make them more specific, transparent,
and accessible. Secondly, the goal is to update theapplicable privacy impact assessments to facilitate
integration of the new products following the acquisition of Lookout Life to ensure a high standard of privacy
and to support the ISO27001 project. Finally, the goal isfor F-Secure Inc to obtain the Data Privacy Framework
Certificate to facilitate EU-US transfers of personal data.

Annual Report 2023

25

Sustainability Statement

ESG Governance information

Sustainability Statement
General information

F-Secure has established its ESG Council to facilitate
the creation and execution of ESG strategy withstakeholders across the company. Furthermore, various
ESG Committees have been established to own theirrespective areas, including employees from different
functions such as Commercial, Marketing, CFO Office,Technology and People & Culture. At F-Secure, ESG
strategy is not considered a separate strategy, butaligned with F-Secure’s corporate strategy and direction, led by the CEO and the Leadership Team.
F-Secure’s Audit Committee including the Chair of theBoard reviews F-Secure’s sustainability strategy andits implementation at least twice a year, and the Boardof Directors at least once a year. At least one personin the Audit Committee has previous expertise ininternational companies and financial ESG reporting in
addition to auditors attending the meeting. During 2023,
plans have also been defined to ensure that the Audit
Committee and the Board of Directors will have accessto sustainability competence and training by 2024.
Further focus areas in 2023, following the Lookout
Life acquisition, included Code of Conduct and cybersecurity related training across F-Secure. Furthermore,
F-Secure recycling and travel policies have been
updated.
As a general note and, looking ahead to 2024, the plan isto re-evaluate the ESG governance model in light of the
EU legislation (CSRD/ESRS).

F-Secure
Board of Directors

F-Secure
Audit Committee

F-Secure
Leadership Team

Environmental information
Approve company strategy and target setting inc. sustainability related topics

Social information
Own workforce

Review sustainability strategy
Review sustainability related policies including but not limited to ESG reporting, Corporate
Governance, Cyber Security, and Risk Management

Responsible for establishing company strategy and direction, inc. ESG strategy

End-customers
Cyber security
ESG Governance information

Risk Management review in minimum twice a year

Purpose• Identify and assess ESG opportunities and risks
F-Secure
ESG Council• Develop and implement strategies and plans to address above• Propose targets and goals, and develop policies & procedures• Drives ESG compliance, and provides views on certifications and standards
Participants: CFO, CPO, General Counsel, SVP Corporate Development, Group ESG lead,
members from Marketing, Technology and ESG Committees (on-demand basis)

ESG Committees
DEI

Health &Wellbeing (H&W)

Environment

Reviews and setsambition on DEI
related plans.
Evaluates andprovides feedback
on progress.

Reviews and setsambition on H&W
related plans.
Evaluates andprovides feedback onprogress.

ESG Council is
responsible fordriving environmental
initiatives andachievingsustainability targets.

ESG Function

General Counsel

ESG is partof Corporate
Development
function leading
ESG Council andfacilitating ESG
strategy execution
and reporting. With
Legal team ensures
ESG activities
meet regulativerequirements.

Align ESG
governance with theoverall corporate
governance andCode of Conductand other relevant
policies.

Annual Report 2023

26

Sustainability Statement

Sustainability Statement

Risk management
Sustainability related risks and opportunities aremanaged as part of F-Secure’s risk management
process as described in the Corporate Governancesection.
In short, the primary goal of F-Secure’s risk management principles is to enable the organization to identify
and manage risks more effectively. The risk management process monitors the potential negative impact
and likelihood of various situations arising from thecompany’s operations, its markets, its customers or its
partners.
F-Secure encourages continuous risk assessment by
the company’s personnel. The relevant operationalrisks identified through the risk management process
are regularly reviewed by each function, including
the twice a year review with the President and CEO
and the Leadership Team, and the Audit Committee.

General information
Company’s statutory auditor reviews risks part of eachinterim release (quarterly). These risks and opportunities include topics such as– Attracting, developing, and retaining talent– Privacy and security related to, e.g., how we use andprotect consumer or partner data
– Cyber security threats related to end-customers,
partners, and our operations– Business continuity risks to our operations including
suppliers, some of which may be related to civil
unrest, public health, adverse effect to climatechange and similar

Environmental information
Social information
Own workforce
End-customers
Cyber security
ESG Governance information– Non-compliance with regulations and violation of our
ethical standards like the Code of Conduct
Risk management is an integrated part of F-Secure
governance and management, and the risk management process is aligned with the ISO-31000:2018
guidelines. The Audit Committee regularly evaluates
the effectiveness of the risk management system.

Annual Report 2023